The other day, I talked about swapping methods in and out of ColdFusion components at run time. I did this by altering the methods defined in the component object:
Launch code in new window » Download code as text file »
... and then was able to call the new method directly, as if it were (and it was) a method of the component itself:
Launch code in new window » Download code as text file »
This was pretty cool, and it turns out, this is the idea behind ColdFusion Mixins which I had only heard about but never really researched.
What's neat about this is that the method auto wires itself into the appropriate scopes. Meaning, if the method refers to the THIS or the VARIABLES scope, then those references automatically refer to the THIS and VARIABLES scope of the methods new parent scope (ie. the component itself). Nicely done ColdFusion!
To take this one step in another direction, I wanted to see what would happen if you treated methods as behaviors, not as children of the component. To test this, I have created my Stripper object:
Launch code in new window » Download code as text file »
As you can see, the Stripper keeps track of what articles of clothing she is wearing via several VARIABLES-scoped values. There is also a private array, Actions, which will hold the action the Stripper must perform during her strip tease. We can add actions to this array at any time and then ask the stripper to strip. Once she does this, she returns the status of her clothing. To demonstrate this, let's create a stripper and ask her to strip, having not provided any actions:
Launch code in new window » Download code as text file »
This gives us the following output:
Wearing Shirt: Yes
Wearing Pants: Yes
Wearing Bra: Yes
Wearing Panties: Yes
Since no actions were assigned, no clothing was removed (oh well).
Now, let's create a few actions that we can send her way.
Launch code in new window » Download code as text file »
As you can see, all of these functions are referencing the VARIABLES scope. Called on their own, they will not work, as free-floating functions do NOT have VARIABLES scopes. We could set these as built-in methods of the Stripper component, but that is what we have already tested. Let's try adding some of these to the Stripper's Action array and then asking her to strip again:
Launch code in new window » Download code as text file »
This gives us the following output:
Wearing Shirt: No
Wearing Pants: No
Wearing Bra: No
Wearing Panties: Yes
Awesome! As you can see, even though the methods were not "part" of the component, the scopes transferred over exactly how we would want them to. And, the structure of the ColdFusion component was not changed at all. Let's take a close look at how these are called:
Launch code in new window » Download code as text file »
As you can see, the Strip method just loops over the actions array, get the method point, and then executes it. Pretty cool. ColdFusion, so dynamic, so freakin' cool!
Download Code Snippet ZIP File
Comments (4) | Post Comment | Ask Ben | Permalink | Other Searches | Print Page
Circumventing ColdFusion Component Security Using Dynamic Methods
Skin Spider : Search Page Completed
Minor nit-pick: free-standing functions *do* have a VARIABLES scope - it refers to the page in which the function is called. A function's VARIABLES scope is dynamically bound in the context in which it is called which is why it binds to the CFC's VARIABLES scope after being injected into the CFC and called as part of object.method()...
Posted by Sean Corfield on Mar 14, 2007 at 11:25 AM
Good point. The "context sensitive" Variables binding is pretty cool. It's like the THIS scope in Javascript.
Posted by Ben Nadel on Mar 14, 2007 at 11:28 AM
Ben,
This has to be the most interesting way to learn CFC's I have seen so far ... I actually got ... excited
about the component ...
you know, the object ...
yeah.
E
Posted by Edward Beckett on Apr 20, 2008 at 3:27 AM
@Edward,
Glad you like. Just trying to help people learn ;)
Posted by Ben Nadel on Apr 20, 2008 at 1:29 PM