Colon in URL throws exception when trying to find non-existent module layout


This has been an ongoing issue for us since at least Coldbox 5 and possibly before. I couldn't reproduce it in a stock Commandbox + Coldbox environment until recently.

We added (and then removed) a module in a folder called referees with an entrypoint of refs. We restarted Lucee so the folder is completely gone. Then we tried this URL:

and got this:

That's in the current (5.6) Coldbox release, though IIRC the stack trace was identical in 5.5.

When I started up a fresh Commandbox+Coldbox stock install, it didn't happen; but once I added some modules (both regular CB modules like qb and quick and modules_app modules) then it started happening.

We don't have any valid use cases for wanting to put colons in our URL, but we get malformed URLs, bots, et cetera that will do it, and it hits our general exception handler every time rather than completing the 'page not found' event (which it's obviously got ready to go, from the context of the error).

But this URL:

Correctly gets us:

How or why this is happening is beyond our Coldbox-fu – there should be no difference between these two routes in a stock Coldbox install that doesn't contain a module called either foo or refs or referees. Our Router.cfc is also stock:

I thought for the better part of a year that this had to be something in our apps, but the above errors are right out of stock installs. I'm happy to work through this with anybody and if it is something that our code is doing, pay for the time, because this one has been frustrating us for a while!


Luis Majano


Samuel W. Knowlton



Fix versions