Repository navigation
CLI: config dump / get settings / reload turn 007, 1e3 and 1.5 into numbers #4607
Closed as not planned
Description
The CommandBox CLI commands that read config/settings.cfm turn any numeric-looking value into a number with Val():
cli/src/commands/wheels/config/dump.cfc, around lines 224-225:else if (IsNumeric(local.value)) { local.value = Val(local.value); }cli/src/commands/wheels/get/settings.cfc, around lines 235-236cli/src/commands/wheels/reload.cfc, around lines 116-117
So:
007becomes7;1e3becomes1, becauseVal()reads only the leading digits;- decimals such as
1.5become numbers too.
wheels config dump and wheels get settings can therefore show a value that differs from the one the app actually uses.
The .env parser in public/Application.cfc was changed in #4606 to convert only plain integers (^-?(0|[1-9][0-9]*)$). These three parsers could follow the same rule, and leave decimals as strings the way the .env parser does.
None of the three has the lone-quote crash #4606 fixed. dump.cfc guards its strip with Len(...) >= 2. The other two strip with a regex, so a lone quote becomes an empty string rather than surviving.
Activity
bpamiri commentedon Oct 15, 2026
Correction: this issue says the legacy CommandBox CLI still ships. It doesn't. The
cli/srcwheels-climodule has been frozen since #3184:.github/workflows/release.yml(around lines 218-226 and 361-363) andrelease-candidate.yml(around lines 92-95) no longer prepare, build or publish it.tools/build/scripts/publish-to-forgebox.sh(around lines 222-226) says the same.cli/src/README.mdmarks it deprecated and frozen: "do not extend it".The already-published 4.0.3 module stays as it is, and a change to
cli/srcwould never be republished. So fixing these parsers in the repo wouldn't reach users. The modernwheelsCLI (LuCLI,cli/lucli) doesn't use these parsers;wheels reloadthere reads the password from.env.For the record, the same numeric over-conversion exists in five copies, not three.
config/check.cfcandconfig/diff.cfcalso have it, and those two also strip quotes without a length guard. All five are in the frozen module.Closing as not planned, because the module is frozen. If
cli/srcis ever revived, the right rule there would be: never convert a quoted value, and convert unquoted values only when they aretrue/falseor plain integers.