Another option would be to implement Cloneable , and then add handling for that in DuplicationUtil before the Serializable condition. Then the base class could be responsible for how it gets cloned as it implements the interface.

To answer your question, BoxLang’s duplicate supports both a shallow and deep copy of the CFC based on the second param. It does default to “deep” which I believe is the behavior that cbsecurity is using. Note, the “deep” flag is Lucee only. There’s no way to do a shallow copy in ACF unless they support the structCopy() trick.

One big issue Lucee alway had was serializing and deserializing CFC instances always lost all mixins which was a deal breaker. Will we be having the same issue too?

Lucee’s ComponentImp implements Externalizable which in turn implements Serializable. As such, when they duplicate it, they create the clone by Serializing and DeSerializing. As such, the method we currently use to duplicate is not an apples to apples comparison. We also implement Serializable on components, since the ObjectSerialize requires it.

Since we’re already implementing that, I might suggest using Lucee’s approach for duplication on anything that implements serializable. Granted, though, that will probably more expensive.

Sure, but is it a blind copy? Meaning, does it traverse and duplicate component/class references on the target class? If not, it’s just a shallow copy of the class instance to another class, but all internal references could potentially point to the same memory references.

Are we going to support deep cloning?