CWE-104: Struts: Form Bean Does Not Extend Validation Class
Struts: Form Bean Does Not Extend Validation Class
Weakness ID: 104 (Weakness Variant)
Status: Draft
Description
Description Summary
If a form bean does not extend an ActionForm subclass of the
Validator framework, it can expose the application to other weaknesses related
to insufficient input validation.
Time of Introduction
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Bypassing the validation framework for a form exposes the application
to numerous types of attacks. Unchecked input is an important component
of vulnerabilities like cross-site scripting, process control, and SQL
injection.
Potential Mitigations
Phase
Description
All forms must extend one of the Validation Class (See Context
notes).
Background Details
In order to use the Struts Validator, a form must extend one of the
following: ValidatorForm, ValidatorActionForm, DynaValidatorActionForm, and
DynaValidatorForm. You must extend one of these classes because the Struts
Validator ties in to your application by implementing the validate() method
in these classes. Forms derived from the ActionForm and DynaActionForm
classes cannot use the Struts Validator.
Other Notes
Although J2EE applications are not generally susceptible to memory
corruption attacks, if a J2EE application interfaces with native code that
does not perform array bounds checking, an attacker may be able to use an
input validation mistake in the J2EE application to launch a buffer overflow
attack.
Weakness Ordinalities
Ordinality
Description
Primary
(where the
weakness exists independent of other weaknesses)
Description
