Fix: BoxLang signature failure — use isNull() instead of structKeyExists(arguments,...) for optional date overrides by lmajano · Pull Request #47 · coldbox-modules/s3sdk

lmajano · 2026-09-14T20:04:55Z

Summary

Every signed S3 request (PUT/GET/DELETE/etc.) fails on the boxlang@1 engine with:

Error: Required argument dateStamp is missing for function buildCredentialScope
  at models/Sv4Util.cfc:105

Root cause

In generateSignatureData() (Sv4Util.cfc and the equivalent in Sv2Util.cfc), amzDate and dateStamp are optional parameters with no default:

string amzDate,
string dateStamp

Both call sites in AmazonS3.cfc (s3Request() and getAuthenticatedURL()) omit both entirely, relying on the function to generate them internally. The override check was:

if ( structKeyExists( arguments, "amzDate" ) || structKeyExists( arguments, "dateStamp" ) ) {
    props.dateStamp = arguments.dateStamp;
    props.amzDate   = arguments.amzDate;
}

structKeyExists(arguments, "x") is not a safe way to test "was this optional, no-default argument passed" across engines. On engines with full null support — which is BoxLang's default (unlike Lucee's default partial null support) — an unpassed, no-default argument still exists as a key holding null, so structKeyExists() returns true for it. That makes the if branch run even though neither argument was actually passed, so props.dateStamp = arguments.dateStamp assigns a real null. That null then flows into buildCredentialScope( required string dateStamp, ... ), which BoxLang correctly rejects as a missing required argument.

Lucee/Adobe don't hit this because with their default null handling, an unpassed no-default argument simply isn't a key in arguments at all, so structKeyExists() correctly returns false.

Fix

Check each optional argument independently with isNull(), which works correctly regardless of an engine's null-support model, and also correctly handles the case where only one of the two is passed (the original code would have blindly read the other as null in that case too).

Applied the identical fix to MiniLogBox.cfc's debug()/error()/warn(), which had the same structKeyExists( arguments, "data" ) pattern for its optional data parameter — same root cause, lower-severity symptom (silently logs a spurious null entry instead of throwing, since data isn't a required downstream argument).

Other BoxLang findings

This repo's own CI matrix (.github/workflows/tests.yml) tests boxlang-cfml@1 (BoxLang's CFML-compatibility mode) but not the native boxlang@1 engine, which is why this went uncaught — boxlang-cfml@1's null-handling compatibility shim apparently masks it. A grep across models/**/*.cfc for the structKeyExists( arguments, ... ) anti-pattern turned up no other occurrences beyond the ones fixed here.

Test plan

Confirm signed S3 requests succeed under boxlang@1 (this was discovered via coldbox-modules/cbfs#57, which pulls this module and can be used to verify)

🤖 Generated with Claude Code

https://claude.ai/code/session_01MY8vKDaEubRApVMT9BXSYk

Generated by Claude Code

…nal date overrides structKeyExists(arguments, "x") is not a safe way to test whether an optional, no-default argument was passed: on engines with full null support (BoxLang defaults to this, unlike Lucee's default partial null support), an unpassed argument still exists as a key holding null, so structKeyExists() returns true. In generateSignatureData() (Sv4Util.cfc and Sv2Util.cfc), both callers in AmazonS3.cfc omit amzDate and dateStamp entirely, but on BoxLang structKeyExists(arguments, "amzDate") is still true, so the code reads arguments.dateStamp (a real null) and passes it into buildCredentialScope()'s required dateStamp parameter, which BoxLang correctly rejects as missing: Error: Required argument dateStamp is missing for function buildCredentialScope This breaks every signed S3 request (PUT/GET/DELETE/etc.) on the boxlang@1 engine. Check each optional argument independently with isNull() instead, which is null-support-safe on every engine and degrades correctly when only one of the two is actually passed. Applied the same fix to MiniLogBox.cfc's debug/error/warn(), which had the identical structKeyExists(arguments, "data") pattern for its optional data parameter. Note: this repo's own CI matrix (.github/workflows/tests.yml) tests boxlang-cfml@1 but not the native boxlang@1 engine, which is why this went uncaught.

…ng support, refresh docs and CI matrix - copyObject()/renameObject(): remove manually-set Content-Length header that duplicated CFHTTP's own header on bodyless requests, causing SignatureDoesNotMatch on Adobe CF and BoxLang - Sv4Util.cfc/Sv2Util.cfc: fix dateFormat() mask from "yyyymmdd" (minutes) to "yyyyMMdd" (month) for cross-engine correctness - Fix server-boxlang-cfml@1.json leftover aliases copied from another module - Add native BoxLang (boxlang@1) server config and CI matrix entry - CI matrix: drop lucee@5, adobe@2018, adobe@2021; add lucee@6, adobe@2023, adobe@2025; bump ColdBox to ^8 - box.json: swap commandbox-dotenv/commandbox-cfconfig devDependencies for commandbox-boxlang; update shortDescription - test-harness/box.json: bump coldbox dependency to ^8 - Rewrite readme.md (BoxLang-first, expanded usage/config/testing docs) and update changelog.md - Add AGENTS.md with engine-portability guidance for coding agents - Run cfformat --overwrite across the project Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MY8vKDaEubRApVMT9BXSYk

…b.com/coldbox-modules/s3sdk into fix/boxlang-signature-date-null-check

Breaking changes in this branch (dropped Adobe 2018/2021, Lucee 5, ColdBox 7 support) warrant a major version bump per semver. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MY8vKDaEubRApVMT9BXSYk

github-actions · 2026-09-14T20:23:10Z