dispatch: bare cfabort crashes every Adobe engine in the public-component 404 branch

[bpamiri]

Source

Discussion #3023 (mikegrogan, stock 4.0.3 on ACF 2025). Verified and reproduced on Adobe 2023 — this is an all-Adobe crash, not an ACF 2025 quirk.

Bug

vendor/wheels/Dispatch.cfc:400 ends the enablePublicComponent=false anti-fingerprinting block (issue #2233) with bare cfabort;. That statement form is Lucee-only; Adobe parses it as a reference to an undefined variable named cfabort and throws Variable CFABORT is undefined at runtime.

Blast radius: in testing/production the public component is disabled, and the stock app's homepage is served by it — so GET / on a stock Adobe install in testing/production hits this branch on every request:

• testing (showErrorInformation=true): raw Variable CFABORT is undefined error page (discussion symptom 2).
• production: the block emits Not Found, then the crash bubbles into the friendly error template — composite Not Found + "Something went wrong", HTTP 500 (discussion symptom 3, byte-for-byte).

Repro (docker harness, environment=testing): Adobe 2023 → GET /wheels/info = HTTP 500, body Not Found + CFABORT-undefined error. Lucee 7 control → clean 404 Not Found, 10 bytes.

Why CI never caught it

vendor/wheels/tests/specs/security/PublicComponentProductionSpec.cfc:188-208 validates this branch by source inspection (regex for statuscode=404) — the branch has zero execution coverage on any engine.

Fix

• One token: cfabort; → abort; (only bare-script occurrence in vendor/wheels; public/views/cli.cfm:1085 and wheelstest/.../XMLConverter.cfc:255 are tag-context <cfabort>, fine).
• Add a structural guard spec forbidding bare cfabort; statements in script context across vendor/wheels/**/*.cfc (an abort cannot execute inside a spec without killing the runner, so the structural scan + a documented manual cross-engine repro is the practical gate).
• Acceptance: on BOTH Lucee 7 and Adobe 2023 (docker harness, environment=testing), GET /wheels/info and GET / return clean 404 Not Found with no error template.

Candidate for a new Cross-Engine Invariant in CLAUDE.md: bare tag-in-script statements without parentheses (cfabort;) are Lucee-only — use the script keyword (abort;) or parenthesized form.

[wheels-bot]

Wheels Bot — Triage

Classified as bug.

The report describes an observable crash with a clear "what happened / what I expected": on Adobe CF (2023 + 2025), GET / and GET /wheels/* in testing/production return HTTP 500 (Variable CFABORT is undefined) instead of the intended clean 404 Not Found that Lucee produces. Confirmed at vendor/wheels/Dispatch.cfc:400 — the anti-fingerprinting branch (issue #2233) ends with a bare cfabort;, which Adobe parses as an undefined-variable reference rather than the abort statement.

Suspected layer

dispatch — vendor/wheels/Dispatch.cfc. (No dedicated .ai/wheels/dispatch/ doc exists; the governing reference is .ai/wheels/cross-engine-compatibility.md, since this is a Lucee-vs-Adobe parser divergence.)

Fix sketch

Single-token change in vendor/wheels/Dispatch.cfc:400: cfabort; to abort; (the script keyword is the engine-portable form; the only bare-script occurrence in vendor/wheels — the other cfabort sites are tag-context <cfabort> and fine). Propose-fix should also add a structural guard spec forbidding bare cfabort; in script context across vendor/wheels/**/*.cfc (an abort cannot execute inside a spec without killing the runner, so a source-scan guard plus a documented manual cross-engine repro is the practical gate). Acceptance: on both Lucee 7 and Adobe 2023 (docker harness, environment=testing), GET /wheels/info and GET / return clean 404 Not Found with no error template.

Confidence: medium

The fix shape is mechanical and unambiguous, but the cross-engine auto-downgrade rule fires (Lucee vs Adobe parser behavior differs by definition here) — capping confidence at medium.

<!-- wheels-bot:triage:3029 -->
<!-- wheels-bot:triage-class:bug -->
<!-- wheels-bot:triage-confidence:medium -->

[wheels-bot]

Wheels Bot — Fix proposed

Draft PR: #3032

Spec: vendor/wheels/tests/specs/dispatch/BareCfabortStatementSpec.cfc — failing → passing (structural guard: scans vendor/wheels framework code with comments stripped, forbids bare cfabort; in script context; failed naming /wheels/Dispatch.cfc, now green).

Implementation: vendor/wheels/Dispatch.cfc — single-token cfabort; → abort; in the enablePublicComponent=false 404 branch.

Note: an actual abort cannot execute inside a spec without killing the TestBox runner, so the gate is the structural source-scan plus the documented manual cross-engine repro from the issue (Lucee 7 + Adobe 2023, environment=testing, GET /wheels/info and GET / → clean 404 Not Found). PR opened with Refs #3029 (not Fixes) so the tracking issue stays open until the manual Adobe repro is confirmed by a human.

A human review is required before merge. The Reviewer will weigh in shortly. Doc updates (MDX guides, .ai/wheels/, CLAUDE.md — including the candidate Cross-Engine Invariant that bare tag-in-script statements like cfabort; are Lucee-only) are handled separately by bot-update-docs.yml.