Regression in Lucee 6.1.1.118 for cfspreadsheet java.lang.NoSuchMethodError

[Sgrigson]

There’s a regression in Lucee 6.1.1.118+ compared to prior versions for cfspreadsheet.

<cfspreadsheet action="write"> and SpreadsheetWrite keep throwing an error in that version of Lucee. Specifically a regression from 6.0.1.243.

This is the same whether you use the tag or cfscript-based version.

Here’s some code that runs fine in 6.0.1.243, but fails in subsequent stable versions (and also current 6.2 RC):

qry = queryNew("id,name");
queryAddRow(qry, {id=1,name="Bob"});

spreadsheet = spreadsheetNew("test");
spreadsheetAddRows( spreadsheet, qry );
SpreadsheetWrite( spreadsheet, "test.xls", true );

In my case, in newer versions of Lucee (6.1.1+) this returns the following stack trace:

ErrorType = java.lang.NoSuchMethodError

Message = 'java.lang.Object lucee.runtime.functions.other.CreateObject.call(lucee.runtime.PageContext, java.lang.String, java.lang.String, java.lang.Object, java.lang.Object)'


StackTrace =

 lucee.runtime.exp.NativeException: 'java.lang.Object lucee.runtime.functions.other.CreateObject.call(lucee.runtime.PageContext, java.lang.String, java.lang.String, java.lang.Object, java.lang.Object)'
	at org.cfpoi.spreadsheet.spreadsheet_cfc$cf.udfCall1(/org/cfpoi/spreadsheet/Spreadsheet.cfc:12)
	at org.cfpoi.spreadsheet.spreadsheet_cfc$cf.udfCall(/org/cfpoi/spreadsheet/Spreadsheet.cfc)
	at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
	at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)
	at lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)
	at lucee.runtime.type.scope.UndefinedImpl.call(UndefinedImpl.java:782)
	at lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)
	at lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1992)
	at org.cfpoi.spreadsheet.spreadsheet_cfc$cf.udfCall7(/org/cfpoi/spreadsheet/Spreadsheet.cfc:2161)
	at org.cfpoi.spreadsheet.spreadsheet_cfc$cf.udfCall(/org/cfpoi/spreadsheet/Spreadsheet.cfc)
	at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
	at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)
	at lucee.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:214)
	at lucee.runtime.type.scope.UndefinedImpl.callWithNamedValues(UndefinedImpl.java:800)
	at lucee.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:875)
	at lucee.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:2024)
	at org.cfpoi.spreadsheet.spreadsheet_cfc$cf.udfCall1(/org/cfpoi/spreadsheet/Spreadsheet.cfc:42)
	at org.cfpoi.spreadsheet.spreadsheet_cfc$cf.udfCall(/org/cfpoi/spreadsheet/Spreadsheet.cfc)
	at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
	at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)
	at lucee.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:214)
	at lucee.runtime.ComponentImpl._call(ComponentImpl.java:716)
	at lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)
	at lucee.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:2052)
	at lucee.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:875)
	at lucee.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:2024)
	at spreadsheetnew_cfm$cf.udfCall(/SpreadsheetNew.cfm:9)
	at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
	at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)
	at lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)
	at lucee.runtime.functions.system.CFFunction.call(CFFunction.java:106)
	at common.model.services.dependencies_cfc$cf.udfCall(/codebase/common/model/services/dependencies.cfc:280)
	at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
	at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)
	at lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)
	at lucee.runtime.type.scope.UndefinedImpl.call(UndefinedImpl.java:782)
	at lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)
	at lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1992)
	at common.model.services.dependencies_cfc$cf.udfCall(/codebase/common/model/services/dependencies.cfc:43)
	at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
	at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)
	at lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)
	at lucee.runtime.ComponentImpl._call(ComponentImpl.java:715)
	at lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)
	at lucee.runtime.ComponentImpl.call(ComponentImpl.java:2033)
	at lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)
	at lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1992)
	at administration.subsystems.api.controllers.dependencies_cfc$cf.udfCall(/codebase/administration/subsystems/api/controllers/dependencies.cfc:38)
	at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
	at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)
	at lucee.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:214)
	at lucee.runtime.ComponentImpl._call(ComponentImpl.java:716)
	at lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)
	at lucee.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:2052)
	at lucee.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:909)
	at lucee.runtime.functions.dynamicEvaluation.Invoke.call(Invoke.java:54)
	at one_cfc$cf.udfCallb(/framework/one.cfc:1635)
	at one_cfc$cf.udfCall(/framework/one.cfc)
	at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
	at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)
	at lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)
	at lucee.runtime.type.scope.UndefinedImpl.call(UndefinedImpl.java:782)
	at lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)
	at lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1992)
	at one_cfc$cf.udfCall6(/framework/one.cfc:896)
	at one_cfc$cf.udfCall(/framework/one.cfc)
	at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
	at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)
	at lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)
	at lucee.runtime.ComponentImpl._call(ComponentImpl.java:715)
	at lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)
	at lucee.runtime.ComponentImpl.call(ComponentImpl.java:2033)
	at lucee.runtime.listener.ModernAppListener.call(ModernAppListener.java:476)
	at lucee.runtime.listener.ModernAppListener._onRequest(ModernAppListener.java:212)
	at lucee.runtime.listener.MixedAppListener.onRequest(MixedAppListener.java:41)
	at lucee.runtime.PageContextImpl.execute(PageContextImpl.java:2725)
	at lucee.runtime.PageContextImpl._execute(PageContextImpl.java:2712)
	at lucee.runtime.PageContextImpl.executeCFML(PageContextImpl.java:2683)
	at lucee.runtime.engine.Request.exe(Request.java:45)
	at lucee.runtime.engine.CFMLEngineImpl._service(CFMLEngineImpl.java:1159)
	at lucee.runtime.engine.CFMLEngineImpl.serviceCFML(CFMLEngineImpl.java:1116)
	at lucee.loader.engine.CFMLEngineWrapper.serviceCFML(CFMLEngineWrapper.java:97)
	at lucee.loader.servlet.CFMLServlet.service(CFMLServlet.java:42)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:623)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:199)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:168)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:481)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
	at mod_cfml.core.invoke(core.java:152)
	at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:660)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:346)
	at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:424)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:936)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1791)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
	at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190)
	at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
	at java.base/java.lang.Thread.run(Unknown Source)
Caused by: java.lang.NoSuchMethodError: 'java.lang.Object lucee.runtime.functions.other.CreateObject.call(lucee.runtime.PageContext, java.lang.String, java.lang.String, java.lang.Object, java.lang.Object)'
	... 107 more

TagContext = ; 
LINE: 12; TEMPLATE: /org/cfpoi/spreadsheet/Spreadsheet.cfc; 
LINE: 2161; TEMPLATE: /org/cfpoi/spreadsheet/Spreadsheet.cfc; 
LINE: 42; TEMPLATE: /org/cfpoi/spreadsheet/Spreadsheet.cfc; 
LINE: 9; TEMPLATE: /SpreadsheetNew.cfm; 
LINE: 280; TEMPLATE: /src2/master/AppCode/common/model/services/dependencies.cfc; 
LINE: 43; TEMPLATE: /src2/master/AppCode/common/model/services/dependencies.cfc; 
LINE: 38; TEMPLATE: /src2/master/AppCode/administration/subsystems/api/controllers/dependencies.cfc; 
LINE: 1635; TEMPLATE: /src2/master/AppCode/thirdparty/framework/one.cfc; 
LINE: 896; TEMPLATE: /src2/master/AppCode/thirdparty/framework/one.cfc
ExtraInfo = ""

[Sgrigson]

Figured it out. It’s an issue with using the .lar archive for cfspreadsheet.

Prior fixes (using cfspreadsheet as a resource rather than an archive) this solves the issue.

Something was introduced in 6.1.1 that effectively broke reading cfspreadsheet via the .lar file.

[Leftbower]

See here for reasons/fix:
https://luceeserver.atlassian.net/jira/software/c/projects/LDEV/issues/LDEV-4772

Perhaps they forgot to add backward compatibility for old bytecode again?

[Sgrigson]

Yeah, that fix definitely isn’t in 6.1.1.118 or 6.2 RC, or if it is, it didn’t address the issue.

[Behnam]

@Sgrigson

Prior fixes (using cfspreadsheet as a resource rather than an archive) this solves the issue.

Hi, How can i use cfspreadsheet as a resource?

[Sgrigson]

There’s notes about it here:

Cfspreadsheet.cfc Error after upgrade 6.0.0.585

So I can verify that there seems to be an issue/difference with Lucee 6 reading a cfc inside a .lar file. A quick workaround is to unzip the cfc-archive-cfspreadsheet.lar file and then switch the Component Mapping in the Lucee admin from “Archive” to “Resource”: [Screenshot 2023-12-20 165018] Change to this: [Screenshot 2023-12-20 165759] Do that and you’re good to go… I filed a bug with Lucee: LDEV-4772 The only reason I even used a .lar in the first place when Railo forked to Lucee was…

Note that the .lar file is just a .zip file with a changed extension.

[Behnam]

thanks for your reply.
I done the below steps:

1. rename cfc-archive-cfspreadsheet.lar to cfc-archive-cfspreadsheet.zip
2. Unzip the file.
3. login into lucee Administrator Panel, Component then edit the cfspreadsheet
4. change to resource and path: E:\lucee\tomcat\lucee-server\context\archives\cfc\cfspreadsheet\org\cfpoi\spreadsheet\Spreadsheet.cfc
5. restart Lucee

But it does not work!

[micstriit]

i will address that asap

[Behnam]

Hi @micstriit
Can u telll me the address plz?

[Sgrigson]

You need to change the resource to the directory, not the CFC file reference.

Also, restarting Lucee isn’t necessary, it should just work.

[Michael_Sprague2]

Just to help anyone trying to follow this, the paths are not quite correct above. After extracting the archive, you need to point the Resource to the folder where the ORG folder sits. These are the steps that worked for me:

1. Stop Lucee
2. Go to {lucee-install}/tomcat/lucee-server/context/archives/cfc/cfspreadsheet and rename cfc-archive-cfspreadsheet.lar to cfc-archive-cfspreadsheet.zip
3. Unzip the file, making sure that the Org folder ends up in the cfspreadsheet folder.
4. Start Lucee
5. login into lucee Administrator Panel, go to Component then edit the cfspreadsheet entry
6. Change the type to resource, and path: {lucee-install}\tomcat\lucee-server\context\archives\cfc\cfspreadsheet

It should start working after step 6 without a second restart needed.

[JF_Robichaud]

This is still a problem in 6.2.1.122 stable.

If you are using Commandbox and not Tomcat you can still follow @Michael_Sprague2 detailed steps for a workaround, but the paths are different since it’s not on tomcat

Step 2:
{your-commandbox-home}\server\{your-server}\lucee-{your-version}\WEB-INF\lucee-server\context\archives\cfc\cfspreadsheet

Step 6:
{lucee-server}/archives/cfc/cfspreadsheet/

[Zackster]

@Leftbower how about just releasing a new version, at a minimum just removing the ancient class file which was complied with java 6.0 almost a decade ago?

Leftbower/cfspreadsheet-lucee-5/blob/master/lar/org/cfpoi/spreadsheet/spreadsheet_cfc$cf.class

But honestly, nobody should be using such old, unmaintained software, it’s bundling ancient CVE ridden jars

There are multiple XXE vulnerabilities all over the place, as Office files are XML based, your server can be hacked by just by opening a document

https://mvnrepository.com/artifact/org.apache.poi/poi/3.15
https://mvnrepository.com/artifact/org.apache.xmlbeans/xmlbeans/2.6.0
https://mvnrepository.com/artifact/xalan/xalan/2.7.2

As the Community manager for Lucee, I made the call that chasing the dragon of supporting ancient bytecode for a vulnerable extension isn’t a priority.

Please consider at least just releasing an update minus that one class file

As a .lex file is just a zip file, anyone battling this can simply grab the file, delete that crufty old class file I linked above and drop the modified .lex file into the deploy folder

[Leftbower]

@Zackster My apologies, I just haven’t had the time to look at this project in eons as I rarely use it myself except for the most rudimentary functionality…

I removed the compiled class but it does not start without it? It is compiled from the Lucee admin from the “create archive”. I’m unclear how to bundle it so that it installs as a resource rather than a .lar (which would fix the issue)? I see no documentation on how to write the manifest to achieve this (assuming that’s even how it is accomplished)?