coldfusion - Public functions become remotely accessible when implementing onCFCRequest() -

some background:

i'm using oncfcrequest() handle remote cfc calls separately regular cfm page requests. allows me catch errors , set mime types cleanly remote requests.

the problem:

i accidentally set of remote cfc functions public access instead of remote , realized still working when called remotely.

as can see below, implementation of oncfcrequest() has created gaping security hole entire application, an http request used invoke public method on http-accessible cfc.

repro code:

in application.cfc:

    public function oncfcrequest(string cfc, string method, struct args){         cfc = createobject('component', cfc);         return evaluate('cfc.#method#(argumentcollection=args)');     } 

in cfc called remotely:

    public function publicfunction(){         return 'public function called remotely!';     } 

question:

i know check meta data component before invoking method verify allows remote access, there other ways approach problem?

oncfcrequest() doesn't create security hole, you create security hole blindly running method without checking see if it's appropriate first, i'm afraid ;-)

(nb: i've fallen foul of same thing, i'm not having go @ ;-)

so - yeah - do need check metadata before running method. check 1 of things cf passes manage in stead when use handler, , has been explicitly implemented such (see 3039293).

i've written description of issue , solution on blog. observed in comment below use code in there - invoke() - work on cf10+, general technique remains same.