My First ColdFusion Builder Extension - Encrypting And Decrypting CFM / CFC Files

Posted November 19, 2009 at 9:13 AM

Tags: ColdFusion

After watching Simon Free present on ColdFusion Builder Extensions at RIAUnleashed up in Boston, I felt inspired and wanted to come home and start playing around with my own little extensions (get your mind out of the gutter!). As a "hello world" type introduction to the ColdFusion Builder extension arena, I thought I would try and keep it as simple as possible, not dealing with any wizards or response modals; my first extensions - ColdFusion file encryption / decryption - simply sends off an action request to the extension handlers without waiting for any response or supplying one to the user.

 
 
 
 
 
 
 
 
 
 

The ColdFusion Builder extension installation process, menu configuration, and action handling is all defined within the ide_config.xml file that must be in the root of your extension archive (ZIP archive of your CFM files). Since my extension deals with the encryption and decryption of ColdFusion files, this configuration file only wires the extension up to the Project View and specifically to CFM and CFC files.

ide_config.xml

 Launch code in new window » Download code as text file »

  • <application>
  •  
  • <!--
  • ColdFusion Builder extension overview. This is the
  • information that will be presented to the user during
  • the extension installation process.
  • -->
  • <name>ColdFusion File Encryption</name>
  • <author>Ben Nadel</author>
  • <version>0.1</version>
  • <email>ben@xxxxxxxxx.com</email>
  • <description>
  • <![CDATA[
  • <p>
  • This extensions encrypts and decrypts ColdFusion
  • CFM and CFC files using command line utilities
  • (executables). For encryption, it uses the native
  • CFEncode.exe and for decryption, it uses the 3rd
  • party CFDecrypt.exe.
  • </p>
  •  
  • <p>
  • The original ColdFusion files remain intact. The
  • encrypted and decrypted files are created as new
  • files with ".encrypted" and ".decrypted" preceding
  • the file extension (respectively).
  • </p>
  • ]]>
  • </description>
  • <license>
  • <![CDATA[
  • <p>
  • Just don't sue me.
  • </p>
  •  
  • <p>
  • <strong>NOTE:</strong> Using the CFDecrypt.exe
  • utility <em>might</em> be a violation of the Adobe
  • ColdFusion license agreement / terms of use; use
  • at your own discretion.
  • </p>
  • ]]>
  • </license>
  •  
  • <!--
  • The MenuContributions determine where the extension
  • is active within ColdFusion Builder (as defined by the
  • Contribution tags).
  • -->
  • <menucontributions>
  •  
  • <!-- The "ProjectView" is the project navigator. -->
  • <contribution target="projectview">
  •  
  • <menu name="ColdFusion File Encryption">
  •  
  • <!--
  • This will only be avilable on CFM and CFC
  • files (within the project tree) as defined
  • by the following regular epxression for file
  • extensions.
  •  
  • NOTE: Use the (?i) case flag to keep the
  • regular expression case-insensitive (since it
  • is, by default case-sensitive).
  •  
  • NOTE: The pattern must match the ENTIRE file
  • name, not just match within it.
  • -->
  • <filters>
  • <filter
  • type="file"
  • pattern="(?i).+\.cf(m|c)"
  • />
  • </filters>
  •  
  • <!--
  • These are the options that will show up under
  • the "ColdFusion File Encryption" header within
  • the context menu. Each calls a Handler (by ID),
  • defined later in this configuration file.
  • -->
  • <action
  • name="Encrypt"
  • handlerid="encrypt"
  • showresponse="false"
  • />
  •  
  • <action
  • name="Decrypt"
  • handlerid="decrypt"
  • showresponse="false"
  • />
  •  
  • </menu>
  •  
  • </contribution>
  •  
  • </menucontributions>
  •  
  • <!--
  • The Handler define the ColdFusion files that will
  • receive the data posted by ColdFusion Builder when the
  • user selects one of the above actions.
  •  
  • NOTE: These files are located in the "handlers" folder
  • of the extension installation.
  • -->
  • <handlers>
  • <handler id="encrypt" type="cfm" filename="encrypt.cfm" />
  • <handler id="decrypt" type="cfm" filename="decrypt.cfm" />
  • </handlers>
  •  
  • </application>

When you set up the filters for your extension, there are two important caveats to know about: one, the regular expressions used in the filtering must match the entire file name, not just part of it (ie. not just the extension); and two, the regular expressions are case-sensitive by default - to make them case-INsensitive, you have to add the (?i) flag as the very first part of the pattern.

Each action (context menu item) in your extension is mapped to a handler, which is really just a ColdFusion file that ColdFusion Builder calls on your server. I created two handlers (ColdFusion files) - one for encryption and one for decryption.

NOTE: I have included an XML response in both of my handler files, but I have not been able to get them to work - they are supposed to refresh the project view after the new files have been created; I am including them in the following code samples in the hopes that someone will see something blatantly wrong and tell me how to fix it!

encrypt.cfm

 Launch code in new window » Download code as text file »

  • <!---
  • Param the FORM value that will contain the data posted from
  • the ColdFusion Builder extension. This will be in the form of
  • the following XML file:
  •  
  • <event>
  • <ide>
  • <projectview
  • projectname="EncryptDecrypt"
  • projectlocation="C:/..." >
  •  
  • <resource
  • path="C:/.../file.cfm"
  • type="file" />
  •  
  • </projectview>
  • </ide>
  •  
  • <user></user>
  • </event>
  • --->
  • <cfparam
  • name="form.ideEventInfo"
  • type="string"
  • default=""
  • />
  •  
  •  
  • <!---
  • Wrap the entire process around Try / Catch because it relies
  • on a bunch of things that might cause error.
  •  
  • NOTE: This is my first web service. In future iterations, we
  • will do a better job of reporting back any errors.
  • --->
  • <cftry>
  •  
  • <!--- Get the current directory. --->
  • <cfset thisDirectory = getDirectoryFromPath(
  • getCurrentTemplatePath()
  • ) />
  •  
  • <!--- Get the bin directory. --->
  • <cfset binDirectory = (thisDirectory & "..\bin\") />
  •  
  • <!--- Get the log directory (for errors). --->
  • <cfset logDirectory = (thisDirectory & "..\log\") />
  •  
  •  
  • <!---
  • Now that we have all of our directories in place,
  • let's convert the request data into XML so we can access
  • its nodes.
  • --->
  • <cfset requestXml = xmlParse( trim( form.ideEventInfo ) ) />
  •  
  •  
  • <!---
  • Now that we have all of our directories in place, let's
  • grab the resource node's PATH attribute from the XML post
  • into the document we got from ColdFusion builder.
  • --->
  • <cfset resourceNodes = xmlSearch(
  • requestXml,
  • "//resource[ position() = 1 ]/@path"
  • ) />
  •  
  • <!---
  • From the resource PATH attribute node, we can grab the
  • file path to the unecrypted ColdFusion file.
  •  
  • NOTE: While ColdFusion usually doesn't care about the file
  • path seperator, since we are dipping down into the command
  • line, we need to make sure we are using the WINDOWS file
  • path seperator.
  • --->
  • <cfset decryptedFile = reReplace(
  • resourceNodes[ 1 ].xmlValue,
  • "[\\/]",
  • "\",
  • "all"
  • ) />
  •  
  • <!---
  • Based on the decrypted file name, let's create an encrypted
  • file name by adding ".encypted." before the file extension.
  • --->
  • <cfset encryptedFile = reReplaceNoCase(
  • decryptedFile,
  • "(.+?)(?:\.decrypted)?\.(cf(m|c))$",
  • "\1.encrypted.\2",
  • "one"
  • ) />
  •  
  •  
  • <!---
  • Now that we have the path to the unecrypted file and to
  • the target encrypted file, we can run the source through
  • the cfencode.exe command line utility.
  • --->
  • <cfexecute
  • name="""#binDirectory#cfencode.exe"""
  • arguments="""#decryptedFile#"" ""#encryptedFile#"" /v ""2"""
  • timeout="5">
  • </cfexecute>
  •  
  •  
  • <!---
  • Now that we have encrypted the file, we need to tell
  • ColdFusion Builder to refresh it's project tree (since
  • we have created a new file). To do that, we need to grab
  • the project node.
  • --->
  • <cfset projectNode = xmlSearch(
  • requestXml,
  • "//projectview[ position() = 1 ]/@projectname"
  • ) />
  •  
  • <!--- Store the response xml. --->
  • <cfsavecontent variable="responseXml">
  • <cfoutput>
  •  
  • <response>
  • <ide>
  • <commands>
  •  
  • <command name="refreshproject">
  • <params>
  • <param
  • key="projectname"
  • value="#projectNode[ 1 ].xmlValue#"
  • />
  • </params>
  • </command>
  •  
  • </commands>
  • </ide>
  • </response>
  •  
  • </cfoutput>
  • </cfsavecontent>
  •  
  • <!---
  • Now, convert the response XML to binary and stream it
  • back to builder.
  • --->
  • <cfset responseBinary = toBinary(
  • toBase64(
  • trim( responseXml )
  • )
  • ) />
  •  
  •  
  • <!---
  • Set response content data. This will reset the output
  • buffer, write the data, and then close the response.
  • --->
  • <cfcontent
  • type="text/xml"
  • variable="#responseBinary#"
  • />
  •  
  •  
  • <!--- ------------------------------------------------- --->
  • <!--- ------------------------------------------------- --->
  •  
  • <!---
  • We should NOT have made it this far. Either the request
  • prcessed well and the processing is OVER; or, there was
  • an error and the processing skipped directly to the
  • CFCatch block of our try / catch area.
  • --->
  •  
  •  
  • <!--- Catch any errors. --->
  • <cfcatch>
  •  
  • <!--- Log the error to disk. --->
  • <cfdump
  • var="#[ form, variables, cfcatch ]#"
  • format="html"
  • output="#logDirectory##createUUID()#.htm"
  • />
  •  
  • </cfcatch>
  •  
  • </cftry>

As you can see, this file is not doing much more than parsing the posted XML request and routing the resource file (the file the user selected when applying the extension) through the CFEncode.exe command line utility. The decryption functionality is almost identical, except that it uses the CFDecrypt.exe command line utility:

decrypt.cfm

 Launch code in new window » Download code as text file »

  • <!---
  • Param the FORM value that will contain the data posted from
  • the ColdFusion Builder extension. This will be in the form of
  • the following XML file:
  •  
  • <event>
  • <ide>
  • <projectview
  • projectname="EncryptDecrypt"
  • projectlocation="C:/..." >
  •  
  • <resource
  • path="C:/.../file.cfm"
  • type="file" />
  •  
  • </projectview>
  • </ide>
  •  
  • <user></user>
  • </event>
  • --->
  • <cfparam
  • name="form.ideEventInfo"
  • type="string"
  • default=""
  • />
  •  
  •  
  • <!---
  • Wrap the entire process around Try / Catch because it relies
  • on a bunch of things that might cause error.
  •  
  • NOTE: This is my first web service. In future iterations, we
  • will do a better job of reporting back any errors.
  • --->
  • <cftry>
  •  
  • <!--- Get the current directory. --->
  • <cfset thisDirectory = getDirectoryFromPath(
  • getCurrentTemplatePath()
  • ) />
  •  
  • <!--- Get the bin directory. --->
  • <cfset binDirectory = (thisDirectory & "..\bin\") />
  •  
  • <!--- Get the log directory (for errors). --->
  • <cfset logDirectory = (thisDirectory & "..\log\") />
  •  
  •  
  • <!---
  • Now that we have all of our directories in place,
  • let's convert the request data into XML so we can access
  • its nodes.
  • --->
  • <cfset requestXml = xmlParse( trim( form.ideEventInfo ) ) />
  •  
  •  
  • <!---
  • Now that we have all of our directories in place, let's
  • grab the resource node's PATH attribute from the XML post
  • into the document we got from ColdFusion builder.
  • --->
  • <cfset resourceNodes = xmlSearch(
  • requestXml,
  • "//resource[ position() = 1 ]/@path"
  • ) />
  •  
  • <!---
  • From the resource PATH attribute node, we can grab the
  • file path to the ecrypted ColdFusion file.
  •  
  • NOTE: While ColdFusion usually doesn't care about the file
  • path seperator, since we are dipping down into the command
  • line, we need to make sure we are using the WINDOWS file
  • path seperator.
  • --->
  • <cfset encryptedFile = reReplace(
  • resourceNodes[ 1 ].xmlValue,
  • "[\\/]",
  • "\",
  • "all"
  • ) />
  •  
  • <!---
  • Based on the encrypted file name, let's create an decrypted
  • file name by adding ".decypted." before the file extension.
  • --->
  • <cfset decryptedFile = reReplaceNoCase(
  • encryptedFile,
  • "(.+?)(?:\.encrypted)?\.(cf(m|c))$",
  • "\1.decrypted.\2",
  • "one"
  • ) />
  •  
  •  
  • <!---
  • Now that we have the path to the encrypted file and to
  • the target denrypted file, we can run the source through
  • the cfdecrypt.exe command line utility.
  • --->
  • <cfexecute
  • name="""#binDirectory#cfdecrypt.exe"""
  • arguments="""#encryptedFile#"" ""#decryptedFile#"""
  • timeout="5">
  • </cfexecute>
  •  
  •  
  • <!---
  • Now that we have decrypted the file, we need to tell
  • ColdFusion Builder to refresh it's project tree (since
  • we have created a new file). To do that, we need to grab
  • the project node.
  • --->
  • <cfset projectNode = xmlSearch(
  • requestXml,
  • "//projectview[ position() = 1 ]/@projectname"
  • ) />
  •  
  • <!--- Store the response xml. --->
  • <cfsavecontent variable="responseXml">
  • <cfoutput>
  •  
  • <response>
  • <ide>
  • <commands>
  •  
  • <command name="refreshproject">
  • <params>
  • <param
  • key="projectname"
  • value="#projectNode[ 1 ].xmlValue#"
  • />
  • </params>
  • </command>
  •  
  • </commands>
  • </ide>
  • </response>
  •  
  • </cfoutput>
  • </cfsavecontent>
  •  
  • <!---
  • Now, convert the response XML to binary and stream it
  • back to builder.
  • --->
  • <cfset responseBinary = toBinary(
  • toBase64(
  • trim( responseXml )
  • )
  • ) />
  •  
  •  
  • <!---
  • Set response content data. This will reset the output
  • buffer, write the data, and then close the response.
  • --->
  • <cfcontent
  • type="text/xml"
  • variable="#responseBinary#"
  • />
  •  
  •  
  • <!--- ------------------------------------------------- --->
  • <!--- ------------------------------------------------- --->
  •  
  • <!---
  • We should NOT have made it this far. Either the request
  • prcessed well and the processing is OVER; or, there was
  • an error and the processing skipped directly to the
  • CFCatch block of our try / catch area.
  • --->
  •  
  •  
  • <!--- Catch any errors. --->
  • <cfcatch>
  •  
  • <!--- Log the error to disk. --->
  • <cfdump
  • var="#[ form, variables, cfcatch ]#"
  • format="html"
  • output="#logDirectory##createUUID()#.htm"
  • />
  •  
  • </cfcatch>
  •  
  • </cftry>

And that's all there is to it. Like I said above, I could not get the response XML to work and refresh the ColdFusion Builder project. When I log the response, here is what I get - hopefully someone will see what is going wrong here and help me out:

 Launch code in new window » Download code as text file »

  • <response>
  • <ide>
  • <commands>
  • <command name="refreshproject">
  • <params>
  • <param key="projectname" value="EncryptDecrypt" />
  • </params>
  • </command>
  • </commands>
  • </ide>
  • </response>

I took this right out of the documentation and the ColdFusion Builder error log viewer doesn't tell me anything; in fact, the error log viewer in Builder seemed completely useless - it never held any errors related to my extensions. Anyway, if anyone sees something wrong with my response, please let me know.

So that's my "hello world" ColdFusion Builder extension. It took me a few hours to figure out a bunch of the little quirks, but once I got past that, this extensible functionality seems easy to create and potentially very powerful. One of the nicest things about it is that after the extension is installed, I can work directly on the installed ColdFusion files to update the extension functionality in real-time.

Download Code Snippet ZIP File

Post Comment  |  Ask Ben  |  Other Searches  |  Print Page




Learning ColdFusion 9 - ColdFusion 9 tutorials, samples, examples, demos

Reader Comments

Terrence Ryan
Nov 19, 2009 at 10:04 AM // reply »
3 Comments
33 Points

Regarding XML callbacks. I don't think you need to convert them to binary. I use cfheader instead of cfcontent to push it as XML. Check the source of my translator extension to see it in code.
http://translator.riaforge.org/


Ben Nadel
Nov 19, 2009 at 10:07 AM // reply »
7,572 Comments
36,838 Points

@Terrence,

The conversion to binary is only so I can use the "Variable" attribute off of the CFContent tag (which will ensure that *only* the XML is returned and finalizes the response).

I'll take a look your translator, thanks!


Daniel Harvey
Nov 19, 2009 at 11:02 AM // reply »
32 Comments
338 Points

@Ben,

I haven't tried working with this at all but here is something that came to mind.

Did you try using your variable you first create "thisDirectory" when you try to refresh the project?

such as

<param
key="projectname"
value="#thisDirectory#"
/>


Joshua Cyr
Nov 19, 2009 at 11:36 AM // reply »
32 Comments
102 Points

After reading this I suspect many people didn't know the ability to encrypt and decrypt files exist. I wrote up a quick blog post about pros and cons of doing such. http://www.usefulconcept.com/index.cfm/2009/11/19/Encrypting-CFM-Files-with-CFencode


Ben Nadel
Nov 19, 2009 at 1:26 PM // reply »
7,572 Comments
36,838 Points

@Daniel,

The "thisDirectory" variable points to the current location of the extension code, not of the project. We have to get the project information from the posted XML file.


Daniel Harvey
Nov 19, 2009 at 1:29 PM // reply »
32 Comments
338 Points

@Ben,

Ya I guess I should have looked over a little more detail, some reason I thought that was coming from the file being encrypted/decrypted.


Ben Nadel
Nov 19, 2009 at 1:30 PM // reply »
7,572 Comments
36,838 Points

@Daniel,

No worries - it was a good thought.


Daniel Harvey
Nov 19, 2009 at 1:32 PM // reply »
32 Comments
338 Points

@Ben,

Have you tried refreshing the folder instead of the project?


Ben Nadel
Nov 19, 2009 at 1:34 PM // reply »
7,572 Comments
36,838 Points

@Daniel,

Hmmm, not sure if I tried that. I wonder how that works, since I believe in CF Builder, I might not be able to get the name of the folder form the path (as it might be a shared resource or the root of the project). I'll give it a try.


David McGuigan
Nov 20, 2009 at 12:45 AM // reply »
78 Comments
573 Points

Is this the same thing or different than cfcompile? I never get an Allaire header when I use that, it's usually a max of 3 miscellaneous looking characters.

If it is the same, is there any real way to successfully physically protect your CFML source code when distributing it?


Justice
Nov 21, 2009 at 1:13 PM // reply »
86 Comments
926 Points

@Ben,

Because I am pedantic, I just want to make sure that everyone knows there is absolutely no encryption going on. There is only encoding and obfuscation. The cfencode tool only obfuscates your CF code, as stated on {http://livedocs.adobe.com/coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity2.htm}.

Obfuscation merely prevents the casual person from reading your source code immediately. If someone hacked into your laptop, your version control master, or your web server to look at your source, you can bet your behind that he is perfectly able to read your obfuscated code.

But obfuscation typically has no security implications and cannot prevent anyone from understanding the file once he has access to it. Only encryption is capable of doing that, so long as a modern cryptosystem is chosen and the private keys remain safe.

The key difference is: with obfuscation, anyone with a little time and talent can easily understand and alter your source code. But modern a modern encryption algorithm, so long as it does not have gaping flaws, cannot be broken. "AES permits the use of 256-bit keys. Breaking a symmetric 256-bit key by brute force requires 2^128 times more computational power than a 128-bit key. A device that could check a billion billion (10^18) AES keys per second would require about 3×10^51 years to exhaust the 256-bit key space." {http://en.wikipedia.org/wiki/Brute_force_attack} All of the computing power in this world put together is not sufficient to check a billion billion keys per second. In other words, no matter how much time or energy or money you have, it is physically impossible to break something encrypted with AES-256 unless you already know the encryption key.

Cheers,
Justice


Ben Nadel
Nov 24, 2009 at 8:16 AM // reply »
7,572 Comments
36,838 Points

@Justice,

Good clarification; I was not exactly sure what the CFEncode.exe was doing. But, if the code is obfuscated, I wonder how ColdFusion knows to de-obfuscate it before compiling? Perhaps there are markers in the code that it checks for every time that it goes to compile?


Justice
Nov 24, 2009 at 1:47 PM // reply »
86 Comments
926 Points

@Ben,

I'm not sure exactly how cfencode works either. I can state for sure that, according to Adobe's docs, cfencode doesn't encrypt but only obfuscates.

The nice thing about obfuscated code is that, in most scenarios, it does not need to be "de-obfuscated." The obfuscated code can typically be run as-is, at least in the Java and .NET obfuscators I have seen, because the obfuscated code contains within it the code necessary to deobfuscate the rest of itself.

Note that 'jquery.min.js' is the obfuscated version of 'jquery.js' (minification is a form of obfuscation). Also, the 'jquery.packed.js' is also an obfuscated version of 'jquery.js'. Obviously, the files work exactly the same. But in the minified version, internal variables are renamed to something very short, because they are not part of the public API so the renames don't matter. In the packed version, there is a whole lot more going on in terms of obfuscation. In fact, in the packed version, the file contains the JavaScript code needed to unpack the rest of itself, so the browser doesn't have to do anything special - it just runs what it thinks is everyday run-of-the-mill JavaScript code.

Cheers,
Justice


Ben Nadel
Nov 24, 2009 at 1:52 PM // reply »
7,572 Comments
36,838 Points

@Justice,

The concept of something being able to unpack itself is pretty wild! I knew that was going on at some level, but never really thought about it conceptually. Pretty cool stuff!


Jody Fitzpatrick
Nov 30, 2009 at 5:42 AM // reply »
19 Comments
207 Points

Ha Ha -- You crack me up Ben.

Dangy! -- ha.

Great Post.


Post Comment  |  Ask Ben

Recent Blog Comments
Tom Lenz
Mar 22, 2010 at 3:08 AM
Ask Ben: Selecting XML Attributes Given Other XML Attributes
Thanks for the response. I finally discovered that I was getting this error because I had cfsetting enablecfoutputonly="yes" in Application.cfc, and was neither setting it to false elsewhere nor brac ... read »
annie
Mar 21, 2010 at 8:57 PM
The Bourne Ultimatum Starring Matt Damon And Julia Stiles
late to the party, but my observation is this: rewatch carefully for the platonic nature of the relationship between nicki and jason. she never flirts with him. he never comes on to her. they alway ... read »
Joseph D. Gutierrez
Mar 21, 2010 at 7:40 PM
Is Simulating User-Input Events With jQuery Ever A Good Idea?
A couple of things. One you embed the initial state of of more-info in the CSS. IMHO, that behavior should be in jQuery: moreInfo.hide(); It shows that the behavior your toggling and closing is mor ... read »
Sean Corfield
Mar 21, 2010 at 3:59 PM
Exploring ColdFusion Component Runtime Class Properties And Serialization
@Elliott, according to Ben's experiment, serializeJSON() doesn't access the private data by default - it doesn't even access the getHair() method - so trying to clone a Girl.cfc via serializeJSON/des ... read »
Wize
Mar 21, 2010 at 3:49 PM
Ask Ben: Javascript String Replace Method
I'm confused a bit by what you are asking, but if had this sentence: The color, red, is in the style statement; style: red;. and wanted to remove all or change all of the commas, colons, and semi-c ... read »
Lance
Mar 21, 2010 at 3:13 PM
Ask Ben: Javascript String Replace Method
I am trying to make a java program to count the number of times that these punctuation marks occur in a body of text: , : ; . ! - ' " ? / \ I am using this piece to ferret out the commas: numcommas ... read »
Jason Dean
Mar 21, 2010 at 11:13 AM
A New Wrist Pain
@chiropractor suwanee, Spoken like someone trying to sell something. Other than for minor, temporary relief from some back pain, chiropractic treatment is nothing but placebo effect and quackery. ... read »
Delon
Mar 21, 2010 at 6:32 AM
ColdFusion CFPOP - My First Look
Apologies... The field name in the db for C. is "BounceCode" It stores the code / message which is returned in the email. Sorry for the confusion. ... read »