coldbox-reviewer

Review ColdBox application code by applying a checklist-driven process to detect correctness, security, performance, and testability issues. This enforces framework conventions across handlers, services, DAOs, and interceptors to identify anti-patterns and vulnerabilities.

Security checks for ColdBox REST APIs cover input validation, XSS and CSRF prevention, parameterized queries, mass-assignment protection, and authorization checks. This process flags unsafe HQL or SQL and improper status codes in your REST endpoints.

Audit a ColdBox module release by inspecting handlers, routing, and view templates to enforce layering and thin handlers. This review identifies missing allowedMethods, undocumented public APIs, and singleton state leaks.

You can detect ORM N+1 query problems in CFML applications through performance and testability checks. This process evaluates ORM queries to identify caching opportunities and patterns that hinder unit testing.

The best way to ensure testable dependency injection in WireBox is to review DI best practices and singleton usage. This identifies state leaks and patterns that hinder unit testing within your ColdBox services.

This code review approach works for both BoxLang and CFML ColdBox projects. It applies to pull request reviews, codebase audits, module releases, and REST or ORM handler inspections across both environments.