We have been using Coldfusion's Security Sandbox since it was first introduced years ago with out any problems. I mentioned this because I wanted to indicate that we are not new to this feature and totally understand how to set it up and how it works. After moving to ColdFusion10 we are experiencing all kinds of issues with the security sandbox.
We are now getting random "access denied (java.io.FilePermission) errors. It appears, for some reason, the application's sandbox requires access to all the cfmappings we have configured regardless if the indivdual applications requires them or not. This in itself is very troublesome but what makes matter worse is that if we simply refresh the browser we can setp through each 'java.io.FilePermission' error - one for each configured cf mapping until we've refreshed our way through the entire list of our cfmappings - after which we can access our pages normally for a certain period of time. After say 2 hours of inactivity we have to do this all over again.
We're finding this behaviour occurs when we use cfobject calling a local component.
Here is one example:
<cfobject name="myObj" component="/mySite/cfcs/mycfc"> or
<cfobject name="myObj" component="mySite.cfcs.mycfc">
Where "mySite" is the folder name of the application. The cfcs are located within this directory.
We're also experiencing the same behaviour using expandPath()
It is very hard to reproduce consistantly which make it even more difficult to troubleshoot.
Does anyone have ideas why the security sandbox in CF10 is complaining that it needs access to all of our cfmappings and why we can circumvent these errors by simply refreshing the page.
Thanks in advance.
ColdFusion 10 Update 9
We are running serveral instances of ColdFusion10 with multiple sites on each instance
Windows Server 2008 R2 Standard
IIS 7.5