When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
Time of Introduction
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Integrity
Technical Impact: Unexpected state
Demonstrative Examples
Example 1
In the following Java example the class RegistrationForm is a Struts
framework ActionForm Bean that will maintain user input data from a
registration webpage for an online business site. The user will enter
registration data and, through the Struts framework, the RegistrationForm
bean will maintain the user data.
(Bad Code)
Example
Language: Java
public class RegistrationForm extends
org.apache.struts.action.ActionForm {
// private variables for registration form
private String name;
private String email;
...
public RegistrationForm() {
super();
}
// getter and setter methods for private
variables
...
}
However, the RegistrationForm class extends the Struts ActionForm
class which does use the Struts validator plug-in to provide validator
capabilities. In the following example, the RegistrationForm Java class
extends the ValidatorForm and Struts configuration XML file,
struts-config.xml, instructs the application to use the Struts validator
plug-in.
(Good Code)
Example
Language: Java
public class RegistrationForm extends
org.apache.struts.validator.ValidatorForm {
// private variables for registration form
private String name;
private String email;
...
public RegistrationForm() {
super();
}
public ActionErrors validate(ActionMapping mapping,
HttpServletRequest request) {...}
// getter and setter methods for private
variables
...
}
The plug-in tag of the Struts configuration XML file includes the name
of the validator plug-in to be used and includes a set-property tag to
instruct the application to use the file, validator-rules.xml, for
default validation rules and the file, validation.XML, for custom
validation.
Strategies: Input Validation; Libraries or Frameworks
Use an input validation framework such as Struts.
Other Notes
Unchecked input is the leading cause of vulnerabilities in J2EE
applications. Unchecked input leads to cross-site scripting, process
control, and SQL injection vulnerabilities, among others. Although J2EE
applications are not generally susceptible to memory corruption attacks, if
a J2EE application interfaces with native code that does not perform array
bounds checking, an attacker may be able to use an input validation mistake
in the J2EE application to launch a buffer overflow attack. To prevent such
attacks, use the Struts Validator to validate all program input before it is
processed by the application. Ensure that there are no holes in your
configuration of the Struts Validator. Example uses of the validator include
checking to ensure that:
Phone number fields contain only valid characters in phone
numbers
Boolean values are only "T" or "F"
Free-form strings are of a reasonable length and composition
Weakness Ordinalities
Ordinality
Description
Primary
(where
the weakness exists independent of other weaknesses)
Description
