Blog

Curt Gratz

January 21, 2011

Spread the word


Share your thoughts

I ran into a strange error yesterday that I couldn't seem to find out what was happening.

I was getting coldfusion.runtime.TemplateProxy cannot be cast to java.lang.String when trying to save an entity using ColdFusion ORM.  

Google was turning up nothing, so I started systematically removing lines of code.  It started working when I removed the line that did an entityLoad on a different object.  What was weird was I was just using that object to get a bit of data and not even for the object I was saving that caused everything to go boom, and if I removed the save, everything worked fine.  Then I remembered that the Hibernate session is affected so I took a deeper look at the entity that a loaded.  Sure enough, I was autowiring a property and didn't have persistent="false" on that property, causing it to throw the "coldfusion.runtime.TemplateProxy cannot be cast to java.lang.String" error.

Changing it from something like this

property name="shippingOriginationZip" inject="coldbox:setting:shippingOriginationZip";

to this

property name="shippingOriginationZip" inject="coldbox:setting:shippingOriginationZip" persistent="false";

fixed it all up.  Of course, like all coding solutions happen, this was in the middle of the night when I was no longer working on the code that this came to me.

So remember folks, if you have a property in an persistent CFC that is not persistent, be sure to say so!

Add Your Comment

Recent Entries

BoxLang 1.17 Series Part 4 : WriteDump Enhanced!

BoxLang 1.17 Series Part 4 : WriteDump Enhanced!

You call writeDump() on an ORM entity or a very rich class graph . The browser locks up. Thirty seconds later you get a page with forty thousand rows on it, you scroll for a while, you give up, and you go edit your code to dump a sub-key instead. Or worse, you crash the server.

Luis Majano
Luis Majano
September 11, 2026
BoxLang AI 3.4 Blog Series Part 4 : Locking Down Prompt Injection

BoxLang AI 3.4 Blog Series Part 4 : Locking Down Prompt Injection

LLM applications face a class of attack traditional input validation was never built for: prompt injection. An attacker embeds instructions in user input, a retrieved document, a web page your tool fetched, or an MCP result, trying to override your system prompt, exfiltrate data, or hijack a tool call. BoxLang AI 3.4.0 ships four layered, configurable defenses against exactly this, plus one more that's on unconditionally.

Luis Majano
Luis Majano
September 11, 2026