Repository navigation
dispatch: bare cfabort crashes every Adobe engine in the public-component 404 branch #3029
Description
Source
Discussion #3023 (mikegrogan, stock 4.0.3 on ACF 2025). Verified and reproduced on Adobe 2023 — this is an all-Adobe crash, not an ACF 2025 quirk.
Bug
vendor/wheels/Dispatch.cfc:400 ends the enablePublicComponent=false anti-fingerprinting block (issue #2233) with bare cfabort;. That statement form is Lucee-only; Adobe parses it as a reference to an undefined variable named cfabort and throws Variable CFABORT is undefined at runtime.
Blast radius: in testing/production the public component is disabled, and the stock app's homepage is served by it — so GET / on a stock Adobe install in testing/production hits this branch on every request:
- testing (
showErrorInformation=true): rawVariable CFABORT is undefinederror page (discussion symptom 2). - production: the block emits
Not Found, then the crash bubbles into the friendly error template — compositeNot Found+ "Something went wrong", HTTP 500 (discussion symptom 3, byte-for-byte).
Repro (docker harness, environment=testing): Adobe 2023 → GET /wheels/info = HTTP 500, body Not Found + CFABORT-undefined error. Lucee 7 control → clean 404 Not Found, 10 bytes.
Why CI never caught it
vendor/wheels/tests/specs/security/PublicComponentProductionSpec.cfc:188-208 validates this branch by source inspection (regex for statuscode=404) — the branch has zero execution coverage on any engine.
Fix
- One token:
cfabort;→abort;(only bare-script occurrence in vendor/wheels;public/views/cli.cfm:1085andwheelstest/.../XMLConverter.cfc:255are tag-context<cfabort>, fine). - Add a structural guard spec forbidding bare
cfabort;statements in script context acrossvendor/wheels/**/*.cfc(anabortcannot execute inside a spec without killing the runner, so the structural scan + a documented manual cross-engine repro is the practical gate). - Acceptance: on BOTH Lucee 7 and Adobe 2023 (docker harness,
environment=testing),GET /wheels/infoandGET /return clean404 Not Foundwith no error template.
Candidate for a new Cross-Engine Invariant in CLAUDE.md: bare tag-in-script statements without parentheses (cfabort;) are Lucee-only — use the script keyword (abort;) or parenthesized form.
Activity
wheels-bot commentedon Jun 11, 2026
Wheels Bot — Triage
Classified as bug.
The report describes an observable crash with a clear "what happened / what I expected": on Adobe CF (2023 + 2025),
GET /andGET /wheels/*intesting/productionreturn HTTP 500 (Variable CFABORT is undefined) instead of the intended clean404 Not Foundthat Lucee produces. Confirmed atvendor/wheels/Dispatch.cfc:400— the anti-fingerprinting branch (issue #2233) ends with a barecfabort;, which Adobe parses as an undefined-variable reference rather than the abort statement.Suspected layer
dispatch—vendor/wheels/Dispatch.cfc. (No dedicated.ai/wheels/dispatch/doc exists; the governing reference is.ai/wheels/cross-engine-compatibility.md, since this is a Lucee-vs-Adobe parser divergence.)Fix sketch
Single-token change in
vendor/wheels/Dispatch.cfc:400:cfabort;toabort;(the script keyword is the engine-portable form; the only bare-script occurrence invendor/wheels— the othercfabortsites are tag-context<cfabort>and fine). Propose-fix should also add a structural guard spec forbidding barecfabort;in script context acrossvendor/wheels/**/*.cfc(anabortcannot execute inside a spec without killing the runner, so a source-scan guard plus a documented manual cross-engine repro is the practical gate). Acceptance: on both Lucee 7 and Adobe 2023 (docker harness,environment=testing),GET /wheels/infoandGET /return clean404 Not Foundwith no error template.Confidence:
mediumThe fix shape is mechanical and unambiguous, but the cross-engine auto-downgrade rule fires (Lucee vs Adobe parser behavior differs by definition here) — capping confidence at
medium.<!-- wheels-bot:triage:3029 -->
<!-- wheels-bot:triage-class:bug -->
<!-- wheels-bot:triage-confidence:medium -->
wheels-bot commentedon Jun 11, 2026
Wheels Bot — Fix proposed
Draft PR: #3032
Spec:
vendor/wheels/tests/specs/dispatch/BareCfabortStatementSpec.cfc— failing → passing (structural guard: scansvendor/wheelsframework code with comments stripped, forbids barecfabort;in script context; failed naming/wheels/Dispatch.cfc, now green).Implementation:
vendor/wheels/Dispatch.cfc— single-tokencfabort;→abort;in theenablePublicComponent=false404 branch.Note: an actual
abortcannot execute inside a spec without killing the TestBox runner, so the gate is the structural source-scan plus the documented manual cross-engine repro from the issue (Lucee 7 + Adobe 2023,environment=testing,GET /wheels/infoandGET /→ clean404 Not Found). PR opened withRefs #3029(notFixes) so the tracking issue stays open until the manual Adobe repro is confirmed by a human.A human review is required before merge. The Reviewer will weigh in shortly. Doc updates (MDX guides,
.ai/wheels/,CLAUDE.md— including the candidate Cross-Engine Invariant that bare tag-in-script statements likecfabort;are Lucee-only) are handled separately bybot-update-docs.yml.docs: add cfabort; Lucee-only invariant to CLAUDE.md and cross-engine…
ci: production/testing-mode smoke job running the environment probes
ci: smoke-env via the setup-wheels-test-env composite, honest Lucee-o…
ci: non-dev environment smoke probes (production/testing matrix) (#3044)
ci: add Adobe 2023 smoke legs so the #3029 failure class is PR-gated (#…