Over on the general public CFML Slack group, a number of folks have reported that latest safety patches for Adobe ColdFusion (each 2023 and 2025) have damaged the usage of U and L constructs in common expression replacements. These flags had been used, respectively, to uppercase or lowercase the following character sequences (typically represented by back-references to captured teams):
u– uppercase the subsequent letter.U– uppercase the remainder of sequence (or as much asE).l– lowercase the subsequent letter.L– lowercase the reset of the sequence (or as much asE).
With the latest safety updates, these flags at the moment are handled as regular escape sequences. That means u turns into the literal u and L turns into the literal L. Each of which (now surprisingly) present up within the resultant string.
I do not use these fairly often, particularly since they solely work within the POSIX-based common expressions, not the Java ones; however, they do present up from time-to-time. In truth, my present implementation of ucFirst() — my polyfill of the Lucee-only built-in operate — is utilizing them.
Within the following demonstration of ucFirst(), I am capturing phrase characters at delimited boundaries; after which I am utilizing the u flag to uppercase these captured characters within the resultant string:
<cfscript>
writeDump([
ucFirst( "hello" ),
ucFirst( "hello my friend" ),
ucFirst( "hello my friend", true ),
ucFirst( "les états-unis" ),
ucFirst( "les états-unis", true ),
]);
/**
* I capitalize the primary letter of the given string. If "all", I capitalize the primary
* letter of every phrase inside the string. A phrase is classed as any alpha characters
* that come after whitespace, dot, sprint, or parenthesis.
*/
non-public string operate ucFirst(
required string enter,
boolean doAll = false
) {
if ( doAll ) [s.()-])(w)", "1u2", "all" );
return enter.reReplace( "^(w)", "u1" );
}
</cfscript>
This was working high quality a number of weeks in the past; and now once I run this in Adobe ColdFusion 2025 replace 14, I get the next output:
As you’ll be able to see, the u in my reReplace() name is interpreted because the escape sequence for a literal worth, not the uppercase flag. My present implementation of ucFirst() is damaged.
Now, as luck would have it, I lately wrote about how Adobe ColdFusion’s enhanced Java integration — as of 2025 replace 8 — permits me to go CFML closures into Matcher::replaceAll(). This provides me the flexibility to execute CFML code on a per-match foundation. Which implies that I can substitute my u flag with an express .ucase() name.
Utilizing the Sample / Matcher mechanics makes this strategy extra verbose; however, it will get across the damaged function. And by “upgrading” my common expression engine from the POSIX to the Java, I can use the (?U) flag — to not be confused with the U flag — to get the w character class to match on worldwide letters as properly.
<cfscript>
writeDump([
ucFirst( "hello" ),
ucFirst( "hello my friend" ),
ucFirst( "hello my friend", true ),
ucFirst( "les états-unis" ),
ucFirst( "les états-unis", true ),
]);
/**
* I capitalize the primary letter of the given string. If "all", I capitalize the primary
* letter of every phrase inside the string. A phrase is classed as any alpha characters
* that come after whitespace, dot, sprint, or parenthesis.
*/
non-public string operate ucFirst(
required string enter,
boolean doAll = false
) {
if ( enter.len() <= 1 ) {
return enter.ucase();
}
if ( ! doAll ) {
return ( enter[ 1 ].ucase() & enter.proper( -1 ) );
}
// Now that we're utilizing Java Patterns, we will use the UNICODE flag `(?U)`
// to get the decrease case letters (`p{Decrease}`) to match on overseas characters.
return new java( "java.util.regex.Sample" )
.compile( "(?U)(^|[s.()-])p{Decrease}" )
.matcher( enter )
.replaceAll( ( matcher ) => matcher.group().ucase() )
;
}
</cfscript>
For every match, my closure is now getting used to calculate the alternative worth. And, on this context, the matcher.group() worth is all the matched sequence ending within the p{Decrease} character. Operating this Adobe ColdFusion 2025 code provides me the next output:
Works like a attraction. It is extra heavy-handed and requires extra transferring elements. However, these transferring elements give me higher common expression sample help and extra express management over how the uppercase is being utilized.
