WebDH blog - ColdFusion

Dynamic RSS Feed from ColdFusion and bad characters like Â

Wed, 18 Jul 2012 20:44:00 -0700

Are you creating a dynamic RSS Feed in ColdFusion? Maybe you learned some tips from Pete Freitag's blog article. Maybe you have a feed that has worked fine then one day you encounter an issue where bad character(s) are throwing an error in the RSS feed. If you use Internet Explorer, you may see an error like this: An invalid character was found in text content. Line: 71 Character: 271 At the end of this blog I'll describe a simple fix that helped me and hopefully will help you too. Let's say you work at a fictious company and are responsible for publishing news content to the website. Today, each news release is saved as a content record in your CMS database; title, publish date, keywords, content. For the content, each news release contains a text file saved to the web server's file system, and the path to that file is saved in the database. The content file originated in MS Word from your company's communications department. You create a HTML version of the file, mainly using some simple HTML tags; paragraphs, italics, bold, etc. The website's news.cfm page queries the CMS database for a list of news titles, showing the most recent at the top. If a user clicks a news title, they visit the page newsdetail.cfm which does a to display the content file. Maybe this has been working fine for years but now your company wants to offer a RSS Feed of the last 10 news releases. No problem, you read Pete's blog and whip out the page newsrss.cfm coded like this.




  select id,title,pubdate,contentpath
  from news_table
  order by pubdate desc




Company ABC News Releases
http://www.companyabc.com/
Company ABC is a worldwide leader in making news that people like to read.
#DateFormat(Now(),'#ddd, d mmm yyyy')# #TimeFormat(DateAdd('h',variables.currentoffset,Now()),'h:mm:ss')# GMT
en-us


#title#
http://www.companyabc.com/newsdetail.cfm?id=#id#
#DateFormat(pubdate,'#ddd, d mmm yyyy')# #TimeFormat(DateAdd('h',variables.currentoffset,pubdate),'h:mm:ss')# GMT
]]>





#variables.xmldata#

If your content source is MS Word, it may contain special characters that are not UTF-8 friendly. Examples: 2010?2012 [long/short dash - you are seeing: 2010â?"2012] ?110 bn [Euro - you are seeing: â?¬110 bn] Castaeda [foreign alpha character - you are seeing: CastaÃ±eeda] value of ? [greek character - you are seeing: value of Î¸] [angled quotes - you are seeing: â??my quoteâ??] rental. Minneapolis [double space - you may see nothing obvious or maybe you are seeing: rental. Â Minneapolis] The fix is very simple, just append charset=utf-8 in this line at bottom of page:

For some reason, even though you have the browser does not always interpret it that way. Read this blog to learn more

My page scraper and Twitterfeed

Sat, 10 Mar 2012 10:36:00 -0700

I recently built a small CF app to scrape the Minnesota Twins website. They have a page that is updated once a week (usually Monday) with a new winner of a special prize given to a Season Ticket Holder (STH). I didn't want to remember to check the page every week, so an automated solution was in order. I created a page scraping template which makes a cfhttp call to the Twins site and parses the HTML for the winner's name and prize. I then check the winner's name against the previous week's winner, and if it differs it saves the new data into the database and emails me the new winner and prize. To make it automated, I created a CF scheduled task that runs once a day and calls the scraping template. To spread the app to other STH peeps, I expanded it further: 1) Email to subscribers each time a new winner is updated 2) Tweet by @FanInMN each time a new winner is updated 3) RSS feed of the winners To achieve 2 and 3, the scraping template also updates a RSS feed. This feed is used by Twitterfeed, which automatically tweets the new winner. Thanks to Josh Adam's blog for the tip Twitterfeed, it was very easy to setup. If you are a Twins STH, you can subscribe here. Go Twins!

Using ColdFusion to Deflate compress a SAML XML authentication message

Fri, 17 Sep 2010 11:16:00 -0700

I am working on a ColdFusion project that uses SAML to authenticate users. I won't get into all the specific application details as they are quite complicated. However, the point of this blog post is to explain the components of the authentication request XML message that gets DEFLATE compressed, Base64 encoded and URL encoded. I hope some of this can help others dealing with SAML and/or Deflate compression in their projects. To implement "DEFLATE compressed" I knew Java would come into play and I found this resource which explained the Java Deflater class. This is the example Java code I needed to represent in ColdFusion.


/* Encode a String into bytes */
String inputString = "blahblahblah??";
byte[] input = inputString.getBytes("UTF-8");

/* Compress the bytes */
byte[] output = new byte[100];
Deflater compresser = new Deflater();
compresser.setInput(input);
compresser.finish();
int compressedDataLength = compresser.deflate(output);

I had a hard time finding any help on how I could create the Java byte array "output" variable in ColdFusion. Luckily, I came across this old 2004 blog post from Christian Cantrell. This find was a life saver, thanks Christian! Here is Christian's code:

Here is my final ColdFusion code that represents the original Java example above.









saml_deflate = createObject("java", "java.util.zip.Deflater");
saml_deflate.init(9,true);
saml_deflate.setInput(saml_xml.getBytes("UTF-8"));
saml_deflate.finish();
compressedDataLength = saml_deflate.deflate(output);
data64 = toBase64(output,"UTF-8");
data64url = urlencodedformat(data64);

Before the ColdFusion code above, you start with the SAML XML message like this, which is saved in the CF variable "saml_xml", and the final result is in the CF variable "data64url".




http://theissuer.domain.org/app/

Using ColdFusion with a stubborn MS Access Date/Time field

Sat, 20 Mar 2010 17:16:00 -0700

I have a small application using a MS Access database. Yes, I know all the reasons why it shouldn't be used, let's not go there. Fact is, many developers still use Access for small apps, prototyping, etc, and may come across the same roadblock in which I figured out a solution. For reference, today's date is 3/19/2010 which was used in the query examples shown.

Requirement: Query a table of Jobs (JobTitle, Dept, Salary, etc) that contains a Date/Time field named PostingEndDate. This field is configured as Required = No. That means the admin user who populates records in the table will either supply a date, or may leave the date blank. Think of it as a field that allows NULL in MS SQL. On the end-user side, the query needs to list only current jobs by filtering the records where:
1) PostingEndDate has not passed today's date
OR
2) PostingEndDate is empty (blank value means the Job can be displayed to the user indefinitely) Here is a cfdump (jobList_raw) of all records:


SELECT   JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM     tblJob 
WHERE 	 ActiveJob = 1
ORDER BY JobTitle

Problem: no easy way to write the WHERE clause. Here are some attempts:
1) Len(PostingEndDate) = 0
No error, but does not pick up those with blank dates:


SELECT   JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM     tblJob 
WHERE 	 ActiveJob = 1
AND   (Now() <= PostingEndDate OR Len(PostingEndDate) = 0)
ORDER BY JobTitle

2) PostingEndDate = ''
Generates error: [Macromedia][SequeLink JDBC Driver][ODBC Socket][Microsoft][ODBC Microsoft Access Driver] Data type mismatch in criteria expression.
We can't compare the date field to an empty string.


SELECT   JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM     tblJob 
WHERE 	 ActiveJob = 1
AND   (Now() <= PostingEndDate OR PostingEndDate = '')
ORDER BY JobTitle

3) Cstr(PostingEndDate) = ''
Generates error: [Macromedia][SequeLink JDBC Driver][ODBC Socket][Microsoft][ODBC Microsoft Access Driver] Invalid use of Null
This was my attempt to Cast the date to a string using an Access function. Guess not.


SELECT   JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM     tblJob 
WHERE 	 ActiveJob = 1
AND   (Now() <= PostingEndDate OR Cstr(PostingEndDate) = '')
ORDER BY JobTitle

Solution: write a ColdFusion Query of Query (QoQ) to UNION the two conditions into one resultset. Here are the steps that lead to the final solution.
1) I still need a way to get a string representation (varchar) of the date field. So I added another column (PostingEndDate_str) to the Query object.

2) Loop query and populate the new varchar field. This was intended to produce a blank string for what cfdump showed as [empty string]. Then I should be able to use: PostingEndDate = ''

NOPE! Still see [empty string] in the new field, THIS BECAME THE HAIR PULLING MOMENT OF THE SOLUTION AT THIS POINT, SO I STARTED GOOGLE SEARCHING.
I decided to try using '-' before and after the value, a trick I noticed in Ben Nadel's blog:

Now I see "--" for all those [empty string] values, much better. I can work with that in the QoQ.
3) Last is the Query of Query UNION.


SELECT	JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM    jobList_raw 
WHERE   #ParseDateTime(DateFormat(Now(),'mm/dd/yyyy'))# <= PostingEndDate  
UNION
SELECT	JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM    jobList_raw 
WHERE 	 PostingEndDate_str = '--'  
ORDER BY JobTitle

Here is the final recordset. It correctly leaves the Architect job filtered out because its PostingEndDate of Mar 9, 2010 has passed. The Mortgage Processor and Supervisor jobs with blank dates are kept in the results!

Excited for special ColdFusion Builder event in St. Paul on March 23

Wed, 17 Mar 2010 21:56:00 -0700

Josh Adams, Adobe Senior Solutions Engineer for ColdFusion, will be presenting live as part of a special CFUG tour. Josh will bring us the latest details and demonstration of the new Eclipse based IDE, ColdFusion Builder. We are planning for a fun event hosted at our usual user group location, Easel Solutions. Adobe is shipping us some special event swag as well, so be there for chance to take home a unique prize. Hope to see a packed house, register now! www.colderfusion.com/CFBuilder10.cfm Date: Tuesday, March 23, 2010 Agenda:
5:45 Food and Social
6:30 Presentation begins
8:15 Q & A - Prizes
8:30 After party at local bar TBD Location: Easel Solutions, St. Paul, MN Updated 3/24/2010
We had a great event, here are some pics!

ColdFusion Builder - Josh Adams - March 2010

ColdFusion UG Tour coming to St. Paul June 11

Sun, 31 May 2009 23:36:00 -0700

I'm thrilled to report that Ben Forta is visiting the Twin Cities again as part of the Adobe worldwide user group tour for the upcoming versions of ColdFusion and Flex. I got the official word a few weeks ago and have been head down in planning mode ever since. Figuring attendance will bust down the doors at Easel Solutions, we needed a bigger venue, so I made a bunch of calls, sent emails, and even visited one potential location. In the end we choose the University of St. Thomas, St. Paul Campus and I think it is going to work out great. I want to thank the TCCFUG's co-manager, Ben Ellefson, for major work on the event registration website. It's now live and I urge you to get this on your calendar and register now. This is one user group meeting you will not want to miss, plus you'll be fed and could win an IPod touch to boot. Hope to see you there! Updated 6/12/2009
We had a great event, here are some pics!

Adobe CF9/Flex4 UG Tour St. Paul 2009

Update your Twitter status from ColdFusion using a JSP tag library

Wed, 04 Feb 2009 15:35:00 -0700

Today I wanted to find an easy way to put a status update into my Twitter account using ColdFusion. I went searching the API docs, and found this page. http://apiwiki.twitter.com/Libraries Unfortunately, there are no CF examples listed, boo! However, there are some for Java, so I continued my search in that direction. Eventually I found this JSP taglib, and decided to give it a "Twirl" :) http://www.servletsuite.com/servlets/twittertag.htm To use any JSP taglib, you simply drop the .jar file into your /webroot/WEB-INF/lib/ directory. I believe it also requires the Enterprise edition of ColdFusion. A good article that fully explains their usage was done by Charlie Arehart back in May 2002. After copying the file, you must then restart ColdFusion. This is a must or you will get an error when attempting to import the library. That's it, I was now ready to test a Twitter post. Here is the sample code I used that will put a new status message in my Twitter account. I saved this in a file twitter.cfm, then browsed to the page on my local machine as http://localhost/twitter.cfm


 

My posting to Twitter from CF #now()#

Upon success, an XML dataset is returned in the "result" variable. If you cfdump it, looks like this.


  Wed Feb 04 21:29:26 +0000 2009 1177644114 My posting to Twitter from CF {ts '2009-02-04 15:29:28'} web false   false   20062919 Twin Cities CFUG TCCFUG St. Paul, MN USA Adobe ColdFusion User Group -of Minneapolis / St. Paul, Minnesota http://s3.amazonaws.com/twitter_production/profile_images/75391930/colderfusion_twitter_normal.jpg http://groups.adobe.com/groups/bd9082a926/ false 0

If you fail to restart CF, you will see this TagExtraInfo error message:


The TagExtraInfo class com.cj.twitter.strVariable for the update tag could not be found.

The CFML compiler was processing:
    * A cfimport tag beginning on line 1, column 2.

This is not the best solution if you are in a shared hosting environment, as they may not install the twittertag.jar file for you. I'm curious what other methods developers have found to accomplish status posts to Twitter.

ColdFusion UDFs long2ip() and ip2long()

Tue, 06 Jan 2009 11:57:00 -0700

Yesterday I was working on porting some PHP code into ColdFusion. The PHP code was using a function called long2ip(), and I researched this PHP Manual website to learn more about it. I needed this function in CF, but couldn't find it at cflib or anywhere else doing a few Google searches. The closest I came was this blog post by Brandon Purcell, which got me started in the right direction. I learned from what Brandon wrote, along with the comments input by Gabriel Malca (if the function doesn't exist) at the PHP Manual site and came up with the logic for my CF version of the function. After I had this working, I figured I better implement the opposite conversion function as well, so I also created ip2long(). Again I found a user comment for when the function doesn't exist to base my function's logic. I submitted these to cflib.org today, so look for them soon. Examples:
long2ip(3401190660) = 202.186.13.4
ip2long(202.186.13.4) = 3401190660 Here is the code for UDFs below:



/**
 * Generates an (IPv4) Internet Protocol dotted address (aaa.bbb.ccc.ddd) from the proper address representation. Returns 0 if error occurs.
 * 
 * @param longip Numeric value of the address you want to convert. (Required)
 * @return Returns a String. 
 * @author Troy Pullis (tpullis@yahoo.com) 
 * @version 1, Jan 5, 2009 
 */
function long2ip(longip)
{
	var ip = "";
	var i = "";
    if (longip < 0 || longip > 4294967295) 
		return 0;
    for (i=3;i>=0;i--) {
        ip = ip & int(longip / 256^i);
        longip = longip - int(longip / 256^i) * 256^i;
        if (i>0) 
			ip = ip & ".";
    }
    return ip;
}

/**
 * Converts a string containing an (IPv4) Internet Protocol dotted address (aaa.bbb.ccc.ddd) into a proper address representation.  Returns 0 if error occurs.
 * 
 * @param ip Dotted address value you want to convert. (Required)
 * @return Returns a String. 
 * @author Troy Pullis (tpullis@yahoo.com) 
 * @version 1, Jan 5, 2009 
 */
function ip2long(ip) {
	var iparr = ListToArray(ip,".");
	if (ArrayLen(iparr) != 4)
		return 0;
	else 
	 	return iparr[1]*256^3 + iparr[2]*256^2 + iparr[3]*256 + iparr[4];
}

CFC for Building a Zip Code Proximity Search with ColdFusion

Fri, 07 Nov 2008 15:46:00 -0700

Back in Oct 2005, SysCon published an article I wrote in CFDJ magazine. Unfortunately, the Webmonkey.com tutorial I originally based my article on has been removed by Wired. I contacted them and hopefully they'll dig it up and repost it under their new wiki site. In the meantime, here is a link to the CFC file zipfinder.cfc used in that article. One more note... if you make use of my code examples from the CFDJ article, please write your queries using cfqueryparam, which I should have done in the first place.

Twin Cities CFUG November meeting taking shape

Tue, 28 Oct 2008 09:08:00 -0700

We have a great meeting planned for both intermediate as well as brand new CF developers. This meeting is Wednesday, Nov 5th at Easel Training. Room 1) Kurt Wiersma - BlazeDS
Have you ever wondered what BlazeDS is and what it can do? If so this session is for you. We will cover how you can install BlazeDS inside of CF and how CF can communicate with BlazeDS to make Flex applications get real time messages from ColdFusion. Room 2) Jason Dean - New Developer Breakout Session
This break out session will be an informal meeting for new developers and for developers who are new to CFML. Bring your questions or just learn the basics of ColdFusion. Both topics will be presented simultaneously in different rooms. Learn more at colderfusion.com

Whirlwind trip to BFusion/BFlex was a success

Tue, 09 Sep 2008 15:26:00 -0700

Just got back from the BFusion/BFlex conference and wanted to summarize my weekend. I joined a few local CF developers and we drove 11+ hours to Bloomington, Indiana to attend this FREE 2-day conference put on by some of the Adobe User Groups in conjunction with Indiana University. Day 1 was ColdFusion focused, and I was in the Intermediate Track. We spent a full day of hands on training learning about the Mach II framework. This was my first formal exposure to a framework and it was great to get a recap of OO principles and see them in action. Day 2 was Flex focused and I was in the Beginner Track. We started building a basic photo gallery application following the actual Adobe Flex course materials. I only stayed until noon as we had to get back on the road for the long drive home. Plus, I had a similar training back in April at the local Flex Camp in Minneapolis, so I don't think I missed too much. Highlights of the trip:
- good intro to Mach II, hope to start using it on a small app at work
- my 2nd exposure to Flex, I really need to put this into a work app soon!
- met some new CFers and had a good time at The Upland Brewery restaraunt
- got started on Twitter and now following over 20 others
- scored tons of swag for giveaways at CFUG (CF tag posters, Fusion Authority frameworks issue, Flex Authority first issue, etc)
- won a new book: ColdFusion 8 Developer Tutorial
- arrived there and back home safely as we covered approx 1400 miles by car

Seal Guard Systems pondering ColdFusion

Sat, 09 Aug 2008 15:37:00 -0700

I've started working with a new client over the past couple of weeks. Ken Wolfbauer and Kathi Wolfbauer of Seal Guard Systems who approached me to help with their HTML and SEO. We have been working together in their great showroom in Blaine, MN. I've suggested that they move their site under ColdFusion. I'm looking forward to working with Ken and Kathi to promote their products and services on the Internet, including Milgard fiberglass windows and Metro steel roofing. Hopefully I'll convince Kathi to start using ColdFusion so we can take their website to the next level.

Useful checks to test for XSS attacks on your ColdFusion site

Wed, 25 Jun 2008 14:51:00 -0700

If you have a ColdFusion page that contains a form with text inputs or uses URL params, make sure you are not vulnerable to a XSS attack. I'm quite novice at this myself, but learning more about it recently. Here are some inputs to try in your forms or URL param values, if they echo the value back to the user after the page submits/reloads. This is often done on forms with server side validation when 1 or more errors are found, you preserve the fields already typed by the user and give them an error message to try again.


FORM INPUTS
">XSS
"><

FORM TEXTAREA
<script>alert("XSS")<%2Fscript><
"><"
"+onmouseover=alert("XSS")+
click%20here%22%20onmouseover=%22javasript:alert(%27XSS%27)%22
</code>

The solution is to wrap any value that echos back on the page in HtmlEditFormat(). For example:

<code>
#HtmlEditFormat(URL.firstname)#
or
#HtmlEditFormat(Form.company)#
</code>

Even Ray Camden's blog.cfc is vulnerable. To see what I mean, follow these steps:

1) <a href="http://blog.webdh.com/contact.cfm" target="_blank">Click here to the contact page</a>

2) Enter the following in the Name field:
<code>
"><script>alert("XSS")</script><
</code>

3) Click the <em>Send Your Comments</em> button
</article>
<article>
<h1>ColdFusion infinite loop causes Java heap space error</h1>
<p>Fri, 20 Jun 2008 10:18:00 -0700</p>
If you get an error page like this, and are scratching your head as to why, it's probably an infinite loop in your CFML code. The error I had was this, and sure enough, I had an out of control loop.

<code>
500 

ROOT CAUSE: 
java.lang.OutOfMemoryError: Java heap space
        at java.util.Arrays.copyOf(Arrays.java:2882)
        at java.io.CharArrayWriter.write(CharArrayWriter.java:105)
        at coldfusion.runtime.CharBuffer.replace(CharBuffer.java:37)
        at coldfusion.runtime.CharBuffer.replace(CharBuffer.java:50)
        at
coldfusion.runtime.NeoBodyContent.write(NeoBodyContent.java:254)
        at.........
</code>
</article>
<article>
<h1>Putting ColdFusion to sleep</h1>
<p>Tue, 08 Apr 2008 18:25:00 -0700</p>
Here is a code snippet that makes the ColdFusion processing "sleep" for the specified number of milliseconds.  This works on ColdFusion MX 6 and above, which can expose the Java language from within CFML.

<code>
<cfset thread = CreateObject("java", "java.lang.Thread")>
<cfset thread.sleep(3000)>  <!--- About to sleep for 3 seconds... --->
</code>

ColdFusion 8 introduced a new sleep() function. The above code and the new function are explained in more detail in this <a href="http://coldfusioncookbook.com/entry/61/How-do-I-make-a-template-pause(sleep)?">ColdFusion Cookbook article</a>.
</article>
</main></body></html>