cfwddx

Last update:

May 18, 2026

Description

Serializes and deserializes CFML data structures to the XML-based WDDX format. The WDDX is an XML vocabulary for describing complex data structures in a standard, generic way. Implementing it lets you use the HTTP protocol to such information among application server platforms, application servers, and browsers. This tag generates JavaScript statements to instantiate JavaScript objects equivalent to the contents of a WDDX packet or CFML data structure. Interoperates with Unicode.

Note:

After Update 10 of the 2021 release of ColdFusion and Update 4 of the 2023 release of ColdFusion, we've blocked Wddx serialization of all Java and ColdFusion classes to prevent deserialization vulnerability, which may lead to RCE. The cfserialfilter.txt in the lib folder is an allowlist of classes and packages. Any class or package present in this file will be allowed for Wddx deserialization. The cfserialfilter.txt contains a semicolon-separated list of classes or packages.

You can use the following conventions in the file:

To allow all classes of a package we can use '**'. For example, use java.util.**;
To allow all package classes except one, use java.util.**;!java.util.Date;
To allow a single class, use java.util.Date;

Note: The precedence decreases as you move from left to right in the file.

Classes that are getting blocked are logged in logs/wddx.log. You can add such classes to cfserialfilter.txt. Restart ColdFusion to unblock the classes.

Syntax

action = "cfml2wddx|wddx2cfml|cfml2js|wddx2js"

input = "inputdata"

output = "result variable name"

topLevelVariable = "top-level variable name for JavaScript"

useTimeZoneInfo = "yes|no"

validate = "yes|no" >

Note:

You can specify this tag's attributes in an attributeCollection attribute whose value is a structure. Specify the structure name in the attributeCollection attribute and use the tag's attribute names as structure keys.

History

ColdFusion MX

Changed column name case behavior: ColdFusion preserves the case of column names in JavaScript. (Earlier releases converted query column names to lowercase.)
Changed encoding format support: this tag supports several encoding formats. The default encoding format is UTF-8. The tag interoperates with Unicode.

Attributes

Attribute	Req/Opt	Default	Description
action	Required		cfml2wddx: serializes CFML to WDDX. wddx2cfml: deserializes WDDX to CFML. cfml2js: serializes CFML to JavaScript. wddx2js: deserializes WDDX to JavaScript.
input	Required		A value to process.
output	Required if action = "wddx2cfml"		Name of variable for output. If action = "WDDX2JS" or "CFML2JS", and this attribute is omitted, result is output in HTML stream.
topLevelVariable	Required if action = "wddx2js" or "cfml2js"		Name of top-level JavaScript object created by deserialization. The object is an instance of the WddxRecordset object.
useTimeZoneInfo	Optional	yes	Whether to output time-zone information when serializing CFML to WDDX. yes: the hour-minute offset, represented in ISO8601 format, is output. No: the local time is output.
validate	Optional	no	Applies if action = "wddx2cfml" or "wddx2js". yes: validates WDDX input with an XML parser using WDDX DTD. If parser processes input without error, packet is deserialized. Otherwise, an error is thrown. no: does not perform input validation.

Usage

ColdFusion preserves the case of column names cases in JavaScript. The wddx2js and cfml2js actions create a WddxRecordset javascript object when they encounter a RecordSet java object. The serialized JavaScript code requires a wddx.js file. This tag performs the following conversions:

From	To
CFML	WDDX
CFML	JavaScript
WDDX	CFML
WDDX	JavaScript

For more information, and a list of the ColdFusion array and structure functions that you can use to manage XML document objects and functions, see Using XML and WDDX in the Developing ColdFusion Applications.

The cfwddx tag throws an exception if you attempt to serialize a CFC or user-defined function (UDF).

Example

<html>

<body>

<!--- Create a simple query. --->

<cfquery name = "q" dataSource = "cfdocexamples">

SELECT Message_Id, Thread_id, Username FROM messages

</cfquery>

The recordset data is:...<p>

<cfoutput query = q>

#Message_ID# #Thread_ID# #Username#<br>

</cfoutput><p>

<!--- Serialize data to WDDX format. --->

Serializing CFML data...<p>

<cfwddx action = "cfml2wddx" input = #q# output = "wddxText">

<!--- Display WDDX XML packet. --->

Resulting WDDX packet is:

<xmp><cfoutput>#wddxText#</cfoutput></xmp>

<!--- Deserialize to a variable named wddxResult. --->

Deserializing WDDX packet...<p>

<cfwddx action = "wddx2cfml" input = #wddxText# output = "qnew">

The recordset data is:...<p>

<cfoutput query = qnew>

#Message_ID# #Thread_ID# #Username#<br>

</cfoutput><p>

Was this page helpful?

We're glad. Tell us how this page helped.

Found the answer to my problem Understood the instructions Liked the feature

Other suggestions

We're sorry. Can you tell us what didn't work for you?

Didn't find the answer to my problem Couldn't understand the instructions Didn't like the feature

Other suggestions

Thank you for your feedback. Your response will help improve this page.

Was this helpful?

We are sorry the content didn't meet your needs.

Share additional feedback to help us improve.

0/255 | Character limit exceeded.

Thank you so much for sharing your feedback!