From fc358b53c7f1376627e1baf4422bee46c93a8ca0 Mon Sep 17 00:00:00 2001 From: John Mizerek Date: Mon, 9 Mar 2026 13:11:20 -0700 Subject: [PATCH] Strip control characters from JSON body in saveWizard Lucee's deserializeJSON chokes on control characters in description fields that JSON.stringify escapes but Lucee can't parse. Co-Authored-By: Claude Opus 4.6 --- api/setup/saveWizard.cfm | 3 +++ 1 file changed, 3 insertions(+) diff --git a/api/setup/saveWizard.cfm b/api/setup/saveWizard.cfm index 0351917..dcc1bbd 100644 --- a/api/setup/saveWizard.cfm +++ b/api/setup/saveWizard.cfm @@ -142,6 +142,9 @@ try { throw(message="No request body provided"); } + // Clean control characters that Lucee's JSON parser can't handle + requestBody = reReplace(requestBody, "[\x00-\x08\x0B\x0C\x0E-\x1F]", "", "all"); + data = deserializeJSON(requestBody); businessId = structKeyExists(data, "businessId") ? val(data.businessId) : 0;