Blog

Luis Majano

July 24, 2018

Spread the word


Share your thoughts

What's New With 5.1.2

This is a patch release for ColdBox

Bugs/Regressions

  • [COLDBOX-711] - HTML helper cannot add fontawesome icons in button due to XSS enabled by default
  • [COLDBOX-712] - ColdBox shutdown code that uses CF mappings for modules fails on fwreinit
  • [COLDBOX-713] - addAsset throw error when called from handlers

Improvements

  • [COLDBOX-714] - Too many issues when encoding by default for HTML Helper, revert to non-encoded and provide ways to encode globally and a-la-carte

HTML Helper Changes

The HTML Helper has been migrated to an internal module in this release. It allows you to configure it via the following configuration settings in your ColdBox.cfc.

moduleSettings = {
    htmlHelper = {
        // Base path for loading JavaScript files
        js_path = "",
        // Base path for loading CSS files
        css_path = "",
        // Auto-XSS encode values when using the HTML Helper output methods
        encodeValues = false
    }
}

Injection Shortcut

You can also now inject the HTML helper anywhere using it's injection DSL Shortcut of @HTMLHelper

Add Your Comment

Recent Entries

BoxLang 1.17 Series Part 4 : WriteDump Enhanced!

BoxLang 1.17 Series Part 4 : WriteDump Enhanced!

You call writeDump() on an ORM entity or a very rich class graph . The browser locks up. Thirty seconds later you get a page with forty thousand rows on it, you scroll for a while, you give up, and you go edit your code to dump a sub-key instead. Or worse, you crash the server.

Luis Majano
Luis Majano
September 11, 2026
BoxLang AI 3.4 Blog Series Part 4 : Locking Down Prompt Injection

BoxLang AI 3.4 Blog Series Part 4 : Locking Down Prompt Injection

LLM applications face a class of attack traditional input validation was never built for: prompt injection. An attacker embeds instructions in user input, a retrieved document, a web page your tool fetched, or an MCP result, trying to override your system prompt, exfiltrate data, or hijack a tool call. BoxLang AI 3.4.0 ships four layered, configurable defenses against exactly this, plus one more that's on unconditionally.

Luis Majano
Luis Majano
September 11, 2026
BoxLang 1.17 Series Part 3 : Encrypted Config Secrets

BoxLang 1.17 Series Part 3 : Encrypted Config Secrets

Everyone knows the datasource password should not be sitting in plain text in a config file. Everyone has also, at some point, shipped exactly that, because the alternative was a pile of environment variable plumbing that nobody wanted to build on a deadline. x

Luis Majano
Luis Majano
September 08, 2026