From 13fb5df7ea5c176c8fd995984f697bf13aaaf480 Mon Sep 17 00:00:00 2001 From: Github Actions Date: Thu, 21 May 2026 12:13:10 +0000 Subject: [PATCH 1/4] Version bump --- box.json | 2 +- changelog.md | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/box.json b/box.json index ebe03d4..c5b6db1 100644 --- a/box.json +++ b/box.json @@ -1,6 +1,6 @@ { "name":"ColdBox Security", - "version":"3.7.1", + "version":"3.8.0", "location":"https://downloads.ortussolutions.com/ortussolutions/coldbox-modules/cbsecurity/@build.version@/cbsecurity-@build.version@.zip", "author":"Ortus Solutions.com ", "slug":"cbsecurity", diff --git a/changelog.md b/changelog.md index acb5d79..2e2be4f 100644 --- a/changelog.md +++ b/changelog.md @@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [3.7.1] - 2026-05-21 + ### Fixed - **CRITICAL**: Fixed `JwtService.toEpoch()` and `fromEpoch()` producing incorrect epoch seconds on non-UTC servers. The ISO-8601 baseline string combined with `dateConvert("utc2local", ...)` caused a double timezone shift. Now uses `parseDateTime("1970-01-01T00:00:00Z")` directly, producing correct JWT `iat`/`exp` claims on any server timezone. (Affects versions 3.5.0–3.7.0) @@ -426,7 +428,8 @@ settings = { - Created first module version -[unreleased]: https://github.com/coldbox-modules/cbsecurity/compare/v3.7.0...HEAD +[unreleased]: https://github.com/coldbox-modules/cbsecurity/compare/v3.7.1...HEAD +[3.7.1]: https://github.com/coldbox-modules/cbsecurity/compare/v3.7.0...v3.7.1 [3.7.0]: https://github.com/coldbox-modules/cbsecurity/compare/v3.6.0...v3.7.0 [3.6.0]: https://github.com/coldbox-modules/cbsecurity/compare/v3.5.0...v3.6.0 [3.5.0]: https://github.com/coldbox-modules/cbsecurity/compare/v3.4.3...v3.5.0 From b055f90283ae38fbd59daa6a26fb3ac436e832d3 Mon Sep 17 00:00:00 2001 From: Luis Majano Date: Fri, 19 Jun 2026 14:22:00 +0200 Subject: [PATCH 2/4] - Updates for MySQL indexes on version 8+ and index keys to avoid max key length issues with long VARCHAR fields. The `DBLogger` model now creates indexes with a 255 character prefix for `userAgent`, `host`, `path`, and `referer` fields when using MySQL to prevent exceeding the 3072 byte key limit. --- box.json | 2 +- changelog.md | 4 ++++ models/util/DBLogger.cfc | 8 +++++++- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/box.json b/box.json index c5b6db1..fd9d7cb 100644 --- a/box.json +++ b/box.json @@ -1,6 +1,6 @@ { "name":"ColdBox Security", - "version":"3.8.0", + "version":"3.7.2", "location":"https://downloads.ortussolutions.com/ortussolutions/coldbox-modules/cbsecurity/@build.version@/cbsecurity-@build.version@.zip", "author":"Ortus Solutions.com ", "slug":"cbsecurity", diff --git a/changelog.md b/changelog.md index 2e2be4f..b320c26 100644 --- a/changelog.md +++ b/changelog.md @@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### 🐛 Fixed + +- Updates for MySQL indexes on version 8+ and index keys to avoid max key length issues with long VARCHAR fields. The `DBLogger` model now creates indexes with a 255 character prefix for `userAgent`, `host`, `path`, and `referer` fields when using MySQL to prevent exceeding the 3072 byte key limit. + ## [3.7.1] - 2026-05-21 ### Fixed diff --git a/models/util/DBLogger.cfc b/models/util/DBLogger.cfc index f0a4976..77ff25b 100644 --- a/models/util/DBLogger.cfc +++ b/models/util/DBLogger.cfc @@ -449,8 +449,14 @@ component accessors="true" singleton threadsafe { ]; indexColumns.each( ( key ) => { + var indexDefinition = "#key#"; + // For MySQL, limit VARCHAR(1024) index prefix to avoid exceeding 3072 byte key limit + var longVarcharCols = [ "userAgent", "host", "path", "referer" ]; + if ( getDatabaseVendor() == "MySQL" && longVarcharCols.find( key ) > 0 ) { + indexDefinition = "#key#(255)"; + } queryExecute( - "CREATE INDEX idx_cbsecurity_#key# ON #getTable()# (#key#)", + "CREATE INDEX idx_cbsecurity_#key# ON #getTable()# (#indexDefinition#)", {}, { datasource : variables.settings.firewall.logs.dsn } ); From 9b6c5ad53bc130dcb4efa4160a7d38e2171d82ce Mon Sep 17 00:00:00 2001 From: Luis Majano Date: Wed, 24 Jun 2026 12:41:36 +0200 Subject: [PATCH 3/4] updated all ci actions --- .github/workflows/pr.yml | 2 +- .github/workflows/release.yml | 20 ++++++++++---------- .github/workflows/snapshot.yml | 2 +- .github/workflows/tests.yml | 4 ++-- 4 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index b0bf721..acec4c7 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - uses: Ortus-Solutions/commandbox-action@v1.0.2 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c9069d6..378502e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,15 +38,15 @@ jobs: issues: write steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Setup CommandBox - uses: Ortus-Solutions/setup-commandbox@v2.0.1 + uses: ortus-boxlang/setup-boxlang@1.4.0 with: forgeboxAPIKey: ${{ secrets.FORGEBOX_TOKEN }} - name: Setup Java - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: distribution: "temurin" java-version: ${{ env.JDK }} @@ -79,7 +79,7 @@ jobs: box task run taskfile=build/Build target=run :version=${{ env.VERSION }} :projectName=${{ env.MODULE_ID }} :buildID=${{ env.BUILD_ID }} :branch=${{ env.BRANCH }} - name: Commit Changelog [unreleased] with latest version - uses: EndBug/add-and-commit@v9.1.4 + uses: EndBug/add-and-commit@v10.0.0 if: env.SNAPSHOT == 'false' with: author_name: Github Actions @@ -97,7 +97,7 @@ jobs: - name: Upload Build Artifacts if: success() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ env.MODULE_ID }} path: | @@ -133,7 +133,7 @@ jobs: box forgebox publish --force - name: Create Github Release - uses: taiki-e/create-gh-release-action@v1.8.2 + uses: taiki-e/create-gh-release-action@v1.11.0 continue-on-error: true if: env.SNAPSHOT == 'false' with: @@ -170,17 +170,17 @@ jobs: steps: # Checkout development - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: development - name: Setup CommandBox - uses: Ortus-Solutions/setup-commandbox@v2.0.1 + uses: ortus-boxlang/setup-boxlang@1.4.0 with: forgeboxAPIKey: ${{ secrets.FORGEBOX_TOKEN }} - name: Download build artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: ${{ env.MODULE_ID }} path: .tmp @@ -197,7 +197,7 @@ jobs: # Commit it back to development - name: Commit Version Bump - uses: EndBug/add-and-commit@v9.1.4 + uses: EndBug/add-and-commit@v10.0.0 with: author_name: Github Actions author_email: info@ortussolutions.com diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml index 50c8392..85df9e6 100644 --- a/.github/workflows/snapshot.yml +++ b/.github/workflows/snapshot.yml @@ -30,7 +30,7 @@ jobs: contents: write checks: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Auto-format uses: Ortus-Solutions/commandbox-action@v1.0.2 diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index d1f3a63..34738c3 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -100,7 +100,7 @@ jobs: - name: Upload Test Results to Artifacts if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: test-results-${{ matrix.cfengine }}-${{ matrix.coldboxVersion }} path: | @@ -113,7 +113,7 @@ jobs: - name: Upload Debug Logs To Artifacts if: ${{ failure() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: Failure Debugging Info - ${{ matrix.cfengine }} - ${{ matrix.coldboxVersion }} path: | From 45d23e6f2188bb06da37780e8143e670ee2d9a16 Mon Sep 17 00:00:00 2001 From: Luis Majano Date: Wed, 24 Jun 2026 15:49:01 +0200 Subject: [PATCH 4/4] lint updates --- .bxlint.json | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++ .cflintrc | 62 ----------------------------------------------- 2 files changed, 68 insertions(+), 62 deletions(-) create mode 100644 .bxlint.json delete mode 100644 .cflintrc diff --git a/.bxlint.json b/.bxlint.json new file mode 100644 index 0000000..14b2ed0 --- /dev/null +++ b/.bxlint.json @@ -0,0 +1,68 @@ +{ + "diagnostics": { + "duplicateMethod": { + "enabled": true, + "severity": "error" + }, + "duplicateProperty": { + "enabled": true, + "severity": "error" + }, + "emptyCatchBlock": { + "enabled": true, + "severity": "warning" + }, + "invalidExtends": { + "enabled": false, + "severity": "error" + }, + "invalidImplements": { + "enabled": false, + "severity": "error" + }, + "missingQueryParamCfsqltype": { + "enabled": true, + "severity": "warning" + }, + "missingReturnStatement": { + "enabled": true, + "severity": "warning" + }, + "shadowedVariable": { + "enabled": true, + "severity": "warning" + }, + "unescapedQueryParam": { + "enabled": true, + "severity": "warning" + }, + "unreachableCode": { + "enabled": true, + "severity": "warning" + }, + "unscopedVariable": { + "enabled": true, + "severity": "warning" + }, + "unusedImport": { + "enabled": true, + "severity": "warning" + }, + "unusedPrivateMethod": { + "enabled": true, + "severity": "warning" + }, + "unusedVariable": { + "enabled": true, + "severity": "hint" + } + }, + "include": [], + "exclude": [], + "mappings": {}, + "formatting": { + "experimental": { + "enabled": false + } + } +} \ No newline at end of file diff --git a/.cflintrc b/.cflintrc deleted file mode 100644 index b392d05..0000000 --- a/.cflintrc +++ /dev/null @@ -1,62 +0,0 @@ -{ - "rule": [], - "includes": [ - { "code": "AVOID_USING_CFINCLUDE_TAG" }, - { "code": "AVOID_USING_CFABORT_TAG" }, - { "code": "AVOID_USING_CFEXECUTE_TAG" }, - { "code": "AVOID_USING_DEBUG_ATTR" }, - { "code": "AVOID_USING_ABORT" }, - { "code": "AVOID_USING_ISDATE" }, - { "code": "AVOID_USING_ISDEBUGMODE" }, - { "code": "AVOID_USING_CFINSERT_TAG" }, - { "code": "AVOID_USING_CFUPDATE_TAG" }, - { "code": "ARG_VAR_CONFLICT" }, - { "code": "ARG_VAR_MIXED" }, - { "code": "ARG_HINT_MISSING" }, - { "code": "ARG_HINT_MISSING_SCRIPT" }, - { "code" : "ARGUMENT_INVALID_NAME" }, - { "code" : "ARGUMENT_ALLCAPS_NAME" }, - { "code" : "ARGUMENT_TOO_WORDY" }, - { "code" : "ARGUMENT_IS_TEMPORARY" }, - { "code": "CFQUERYPARAM_REQ" }, - { "code": "COMPARE_INSTEAD_OF_ASSIGN" }, - { "code": "COMPONENT_HINT_MISSING" }, - { "code" : "COMPONENT_INVALID_NAME" }, - { "code" : "COMPONENT_ALLCAPS_NAME" }, - { "code" : "COMPONENT_TOO_SHORT" }, - { "code" : "COMPONENT_TOO_LONG" }, - { "code" : "COMPONENT_TOO_WORDY" }, - { "code" : "COMPONENT_IS_TEMPORARY" }, - { "code" : "COMPONENT_HAS_PREFIX_OR_POSTFIX" }, - { "code": "COMPLEX_BOOLEAN_CHECK" }, - { "code": "EXCESSIVE_FUNCTION_LENGTH" }, - { "code": "EXCESSIVE_COMPONENT_LENGTH" }, - { "code": "EXCESSIVE_ARGUMENTS" }, - { "code": "EXCESSIVE_FUNCTIONS" }, - { "code": "EXPLICIT_BOOLEAN_CHECK" }, - { "code": "FUNCTION_TOO_COMPLEX" }, - { "code": "FUNCTION_HINT_MISSING" }, - { "code": "FILE_SHOULD_START_WITH_LOWERCASE" }, - { "code": "LOCAL_LITERAL_VALUE_USED_TOO_OFTEN" }, - { "code": "GLOBAL_LITERAL_VALUE_USED_TOO_OFTEN" }, - { "code": "MISSING_VAR" }, - { "code" : "METHOD_INVALID_NAME" }, - { "code" : "METHOD_ALLCAPS_NAME" }, - { "code" : "METHOD_IS_TEMPORARY" }, - { "code": "NESTED_CFOUTPUT" }, - { "code": "NEVER_USE_QUERY_IN_CFM" }, - { "code": "OUTPUT_ATTR" }, - { "code" : "QUERYPARAM_REQ" }, - { "code": "UNUSED_LOCAL_VARIABLE" }, - { "code": "UNUSED_METHOD_ARGUMENT" }, - { "code": "SQL_SELECT_STAR" }, - { "code": "SCOPE_ALLCAPS_NAME" }, - { "code": "VAR_ALLCAPS_NAME" }, - { "code": "VAR_INVALID_NAME" }, - { "code": "VAR_TOO_WORDY" } - ], - "inheritParent": false, - "parameters": { - "TooManyFunctionsChecker.maximum" : 20 - } -}