Excel Files From Web Won't Open

I had an interesting issue creep up a bit ago with Excel files that were created by a web application not opening in Excel.

I had a ColdFusion app that would generate reports on the fly for users.  We were using CFHEADER and CFCONTENT to deliver table formatted data as XLSX files.  It had been working fine right up until it didn't.  We hadn't made any changes to the code and checked and confirmed that there were no changes/patches to the system since the last known good report was generated.

As it turns out, in mid-July Microsoft upgraded the security in Excel concerning how it handled HTML files with XLS or XLSX extensions from untrusted locations. Previously, Excel would warn you about the file having a type mismatch and would let you accept opening the file.  From the update, Excel would no longer allow the file to be opened and offered no explanation or error message.

There are a couple of workarounds to open the files:
The first is on a file by file basis -

• Once you have the file, Right-Click on it to get the context menu and select ‘Properties’
• On the ‘General’ tab, click ‘Unblock’ and then ‘OK’
• Open the file as usual. You’ll get this message - 'The file format and extension of filename don't match. The file could be corrupted or unsafe. Unless you trust its source don't open it. Do you want to open it anyway?'
• Click ‘Yes’
• The file will open

Another workaround is to change the Trusted Locations settings in Excel

• Open File > Options > Trust Center > Trust Center Settings > Protected View
• Clear the check-marks from  "Enable Protected View for file originating from the Internet" and “Enable Protected View for files located in potentially unsafe locations”.
• Files pulled from the Internet will open.

If you've been building spreadsheets in ColdFusion with CFCONTENT and CFHEADER, it's time to start using CFSPREADSHEET and the associated functions.

Continue reading →

CSRF/XSRF Protection in ColdFusion 9

Here's another little thing that's come across my desk and I hope my solution can be of some help to others.

I was asked to provide a solution to protect a site from Cross Site Request Forgery (CSRF or XSRF) attacks.  Specifically, there were forms on the site that were considered at-risk for exploitation.  I won't get into great detail on what CSRF is, but basically it's an attack vector that attempts to exploit the trust that a website has in the user's browser to allow malicious actions to take place on the server.  

CF10 has methods for CSRF protection available built in, but the site I was asked to chime in on is on CF9.

So, the forms were vulnerable to a CSRF attack because a malicious user could cause a legitimate, authenticated user to unwittingly submit them.  In order to protect the public facing forms, it's necessary to set up a condition where the server can trust that the form submission is from the legitimate user during their session.  The method CF10 uses is to send a token with the form and check for it on submission.  We can do the same thing by adding just a few lines of code to our forms.

Here's a typical self-posting form:

<cfif structKeyExists(form, 'sendInfo')>

       <p>Your information has been received.</p>

    <cfelse>

      <cfform>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

Let's add a token to the form that the server can check for:

<cfif structKeyExists(form, 'sendInfo')>

       <p>Your information has been received.</p>

    <cfelse>

      <cfset session.foobar = createUUID()>

      <cfform>

            <cfoutput><input type="hidden" name="foobar" value="#session.foobar#"></cfoutput>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

Next, we want the form processor to check for the token:

<cfif structKeyExists(form, 'sendInfo')>    

    <cfif structKeyExists(session, 'foobar') and form.foobar is session.foobar>

       <p>Your information has been received.</p>

       <cfelse>

           <p>The form has a problem</p>

       </cfif>

    <cfelse>

      <cfset session.foobar = createUUID()>

      <cfform>

            <cfoutput><input type="hidden" name="foobar" value="#session.foobar#"></cfoutput>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

And finally, we want to do a little housekeeping by dropping the token from the session when we're done with it:

<cfif structKeyExists(form, 'sendInfo')>    

    <cfif structKeyExists(session, 'foobar') and form.foobar is session.foobar>

       <p>Your information has been received.</p>

       <cfelse>

           <p>The form has a problem</p>

       </cfif>

    <cfset structDelete(session, 'foobar')>

    <cfelse>

      <cfset session.foobar = createUUID()>

      <cfform>

            <cfoutput><input type="hidden" name="foobar" value="#session.foobar#"></cfoutput>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

So there ya' go.  A handful of code and you've got your server recognizing your forms for a one-time post and bouncing them on any attempted re-posting.

Continue reading →

Hotfix for CF Admin Console Vulnerability

Adobe has released a hotfix to address a vulnerability in ColdFusion 10, 9.0.2, 9.0.1 and 9.0 (for Windows, Macintosh and UNIX) whereby an attacker could impersonate an authenticated user and potentially gain access to a secured website/application or ColdFusion’s administrative console.

Take a look at Adobe's Security Bulletin, and  the Tech Note for more information and to download and install the patch.

Continue reading →

CFIMAP, SSL, and CACERT

I was working on a little ColdFusion project the other day.  Something rather uncomplicated actually.  We needed to write an application that would:

1. automatically check a mailbox for messages
2. parse information from valid messages into a database
3. move those messages from the Inbox to another folder
4. delete any other messages from the box

Simple enough to do; now time to test.

I kick-off the process and -

An exception occurred when setting up mail server parameters.
This exception was caused by: javax.mail.MessagingException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors;

Well yippee, CF doesn't have the mail server's cert in its list.  This'll be fun- go generate a cert file and try to remember the command line to install it in CF's stores.

"But wait" says a friend, "there's an app for that" :) .  She clues me in on a little tool called KeyStore Explorer that's much better than all the command line stuff.    I take her advice (my friends are very smart) and grab a download at http://www.lazgosoftware.com/kse/index.html to check it out.  A couple of minutes later I point the tool at the cacerts file  (%cfroot%/jre/lib/security/cacerts) and install the mail server's cert.  No muss, no fuss, no bother.

The parser is humming along like it should and I'm on to the next 'to-do'.

Continue reading →

RSS in Coldfusion

Faster isn't always better, but sometimes it is.

Using the CFFEED tag, I set up an RSS feed on a site in less than 5 minutes. The coding is dead simple and about as straight forward as you can get.

I have a CMS set up so that my content editors can add news items to the site. When they save the new item, the code below fires off and updates the RSS feed

<!--- pull the 20 latest items --->
<cfquery name="getFeedDetails" datasource="#application.db#">
SELECT     TOP (20) ID, Title, NewsText, NewsDate, linkData
FROM         myNewsTable
ORDER BY NewsDate DESC 
</cfquery>

<!--- Set up the structure with the feed meta data --->
<cfscript>
myStruct = StructNew();
mystruct.link = "http://foobar.com";
myStruct.title = "FooBar News";
mystruct.description = "The authoritative online resource on how much wood a 
woodchuck would chuck if a woodchuck would chuck wood.";
mystruct.pubDate = Now();
mystruct.version = "rss_2.0";

// Map the orders column names to the feed query column names.
columnMapStruct = StructNew();
columnMapStruct.publisheddate = "NEWSDATE"; 
columnMapStruct.content = "NEWSTEXT"; 
columnMapStruct.title = "TITLE"; 
columnMapStruct.rsslink = "LINKDATA";
</cfscript>

<!--- Create the feed --->
<cffeed action = "create"
query= "#getFeedDetails#"
properties="#mystruct#"
columnMap="#columnMapStruct#"
outputFile = "myRSS.xml" 
overwrite = "yes"
xmlVar = "myXML">

That's all there is to it. myRSS.xml is a properly formatted feed file.

Continue reading →