CacheBox contains a number of different cache providers ranging from EHCache to Railo's Memcached.  There is also a provider implemented in ColdFusion simply called the "CacheBox Provider" and two of it's stores are the ConcurrentStore and the ConcurrentSoftReferenceStore.  You may have wondered what the "soft reference" part means and why you would want to use it.  If that's you, here's some history and explanation.  

In Java, Whether or not an object is garbage collected from the heap is dependent on whether or not it has "GC roots" or garbage collector roots.  A GC root is a reference chain in memory that ends with a root object that is exempt from garbage collection.  An example would be a thread.  It is represented by an object on the heap, but it can run forever and will never be garbage collected.  Likewise, any objects that thread has "hard" references to will also not be GC'd and anything those objects in turn have references to and so on.  So, a chain of hard references back to a GC root will keep you on the heap. 

So, why does this matter?  A JVM has a static upper bound in regards to heap space and when you're dealing with an in-process cache, you run the risk of putting so many objects in the cache that the JVM runs out of space and you get an out-of-memory error.  The concurrentStore uses a good old hard reference.  CFML only has hard references.  When you set a = b that's always a hard reference.  Java has additional types of references that can exist.  Soft references, phantom references and weak references.  They are represented as a class which sits between the referencing object and the object being referenced.  They provide a way for the referenced object to be accessed, but they don't hold a "hard" reference meaning that at any time, the garbage collector can come along, and if it needs RAM badly, it can collect any objects with a weak reference to them.  Obviously, you would only use this reference type if you were ok with your object not existing the next time you went and looked for it.

So the concurrent soft reference cache uses a concurrent hash map (like a struct, but with better performance due to it's granular internal locking and no-locking reads) which is full of soft reference objects, that in turn point to the real items you've placed in the cache.  When garbage collection runs, it has the option to remove one or all of those items from memory if it wishes.  Every time CacheBox wants to retrieve something from a soft reference store, it has ask the Java soft reference object to hand it over.  When the cache is reaped, it checks for items which have been garbage collected and don't exist any longer and expires them.  So basically, the soft reference store help protect your JVM, but it has to do a little more work to get an item.

Now, that being said, I have rarely had items be garbage collected from a softreference cache provider.  This is in part to the fact that I always monitor my heap sizes and make sure I have plenty of headroom.  

Here's some extra reading if you're still curious about the Java classes: 
http://docs.oracle.com/javase/7/docs/api/java/lang/ref/package-summary.html

And here's some more info about CacheBox providers and stores:
http://wiki.coldbox.org/wiki/CacheBox.cfm#ConcurrentSoftReferenceStore

P.S. Another way you can protect your heap is to set a JVM memory threshold in your CacheBox provider's config.  (This is only available for the internal "CacheBox" providers).  Every time CacheBox goes to set an object in the cache, it will check the percentage of free memory, and if it's too small, it will evict an item or items prior to setting the new one in based on the eviction policy and eviction count.

In ColdBox, Event Handlers, Interceptors, and Plugins are represented as CFCs.  You are probably used to their signatures looking like this:

myhandler.cfc
component extends="coldbox.system.EventHandler"{}

myInterceptor.cfc
component extends="coldbox.system.Interceptor"{}

myPlugin.cfc
component extends="coldbox.system.Plugin"{}

ColdBox is very flexible though and tries to help remove as much boilerplate code for you as possible.  You can actually omit the "extends" attribute all-together from Handlers, Interceptors, and Plugins and Coldbox will automatically add Virtual Inheritance to the components at run time.  That means all the methods you're used to having available to you will still be there, but your code is light, clean, and insulated from internal class changes in the framework.

myhandler.cfc
component {}

myInterceptor.cfc
component {}

myPlugin.cfc
component {}

More info;
http://wiki.coldbox.org/wiki/Plugins.cfm#Component_Declaration
http://wiki.coldbox.org/wiki/Interceptors.cfm#How_do_they_work.3F
http://wiki.coldbox.org/wiki/EventHandlers.cfm#Constructors

P.S. You can tap into the power of Virtual Inheritance with WireBox for your own models as well.  Check out this Wiki link: http://wiki.coldbox.org/wiki/WireBox.cfm#Virtual_Inheritance

If your site ever displays text on the page that end users have control over, you should be concerned about XSS attacks.  This could come in the form of user comments at the bottom of an article, user-generated content, or user profile information.  In many instances, the user should never be entering any HTML and you might simply fully escape that text with HTMLEditFormat() or EncodeForHTML() as you output it.

Other times you may be dealing with a forum or message board that allows some limited markup like bold or underline, but not script or object tags, etc.  There is a very nice Java library from OWASP called AntiSamy that does just that.  AntiSamy is named after the first wide-scale XSS worm ever developed; called Samy.  This worm used malicious JavaScript embeded in MySpace profiles and to infect over 1 million accounts in a single day.

What's cool about AntiSamy is you can create different profiles that control what HTML is valid and what isn't.  This gives you complete control over what text you allow to be stored and output on your site.  Instead of escaping forbidden tags and attributes, AntiSamy removes them entirely from the string.

ColdBox has an AntiSamy plugin to let you tap into this powerful library.  In its simplest form, it looks like this:

#getPlugin("antisamy").clean("<b>Hello <script language='javascript'>alert('haxor!');</script> World</b>")#

Despite the JavaScript block in the middle of the string, the output is "<b>Hello World</b>".  As you can see, the  bold tag is benign and is left alone.  

More info here: http://wiki.coldbox.org/wiki/Plugins:AntiSamy.cfm

P.S. The ColdBox AntiSamy plugin ships with several policies such as ebay (default), myspace, slashdot, and tinymce stored as XML files in /coldbox/system/plugins/AntiSamy-lib/.  If you want to roll up your sleeves, you can even supply a policy of your own making.

The Query Helper plugin is a hidden gem in ColdBox.  This plugin has a handful of super useful functions you can perform against query objects-- some of which you may have gone out of your way to write on your own in the past, or just simply lived without.  Here a brief list of my favorite functions from the Query Helper plugin that allow you to do sweet one-line manipulations of one or more query objects:

filterQuery
Pare down a result set to only the records you want.

sortQuery/sortQueryNoCase
Resort a result set on a column of your choosing.

doLeftOuterJoin
Yes, you heard right-- perform an actual left outer join with two result sets.  This alone is worth the cost of admission.

doQueryAppend
Very handy to union two result sets together quickly.

querySim
Great for mocking and testing.  Allows you to easily create a data set out of one or more lines of of pipe-delimited values.

rotateQuery
Pivots a result set so rows become columns and columns become rows.

There are more goodies in there-- take a look at the docs, or directly in /coldbox/system/plugins/QueryHelper.cfc to find the rest of them.

As usual, the Query Helper plugin can be accessed from any framework object (views, controllers, interceptor) like so:

getPlugin("QueryHelper")

and can be injected into your models like so:

property name="QueryHelper" inject="coldbox:plugin:QueryHelper";

More info here: http://wiki.coldbox.org/wiki/Plugins:QueryHelper.cfm

P.S. Remember, while these functions work great for smaller result sets, watch out for performance issues if dealing with lots of data (tens of thousands of rows).  There are some things databases are better at.

<Click to enlarge>