CWE - CWE-107: Struts: Unused Validation Form (2.6)

Struts: Unused Validation Form

Weakness ID: 107 (Weakness Variant)

Status: Draft

Description

Description Summary

An unused validation form indicates that validation logic is not up-to-date.

Extended Description

It is easy for developers to forget to update validation logic when they remove or rename action form mappings. One indication that validation logic is not being properly maintained is the presence of an unused validation form.

Time of Introduction

Implementation
Operation

Applicable Platforms

Languages

Java

Common Consequences

Scope	Effect
Other	Technical Impact: Quality degradation

Demonstrative Examples

Example 1

In the following example the class RegistrationForm is a Struts framework ActionForm Bean that will maintain user input data from a registration webpage for an online business site. The user will enter registration data and, through the Struts framework, the RegistrationForm bean will maintain the user data in the form fields using the private member variables. The RegistrationForm class uses the Struts validation capability by extending the ValidatorForm class and including the validation for the form fields within the validator XML file, validator.xml.

(Bad Code)

Example Language: Java

public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {

// private variables for registration form

private String name;

private String address;

private String city;

private String state;

private String zipcode;

// no longer using the phone form field

// private String phone;

private String email;

public RegistrationForm() {

super();

}

// getter and setter methods for private variables

...

}

(Bad Code)

Example Language: XML

<form-validation>

</field>

</field>

</field>

<var>

<var-name>mask</var-name>

<var-value>[a-zA-Z]{2}</var-value>

</var>

</field>

<var>

<var-name>mask</var-name>

<var-value>\d{5}</var-value>

</var>

</field>

<var>

<var-name>mask</var-name>

<var-value>^([0-9]{3})(-)([0-9]{4}|[0-9]{4})$</var-value>

</var>

</field>

</field>

</form>

</formset>

</form-validation>

However, the validator XML file, validator.xml, for the RegistrationForm class includes the validation form for the user input form field "phone" that is no longer used by the input form and the RegistrationForm class. Any validation forms that are no longer required should be removed from the validator XML file, validator.xml.

The existence of unused forms may be an indication to attackers that this code is out of date or poorly maintained.

Potential Mitigations

Phase: Implementation

Remove the unused Validation Form from the validation.xml file.

Weakness Ordinalities

Ordinality	Description
Resultant	(where the weakness is typically related to the presence of some other weaknesses)

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Weakness Class	20	Improper Input Validation	Seven Pernicious Kingdoms (primary)700
ChildOf	Category	101	Struts Validation Problems	Development Concepts (primary)699
ChildOf	Weakness Class	398	Indicator of Poor Code Quality	Research Concepts (primary)1000
ChildOf	Category	896	SFP Cluster: Tainted Input	Software Fault Pattern (SFP) Clusters (primary)888

Causal Nature

Explicit

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
7 Pernicious Kingdoms			Struts: Unused Validation Form

Content History

Submissions
Submission Date	Submitter	Organization	Source
	7 Pernicious Kingdoms		Externally Mined

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Potential_Mitigations, Time_of_Introduction
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Description, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
2010-06-21	CWE Content Team	MITRE	Internal
2010-06-21	updated Demonstrative_Examples
2011-06-01	CWE Content Team	MITRE	Internal
2011-06-01	updated Common_Consequences
2011-06-27	CWE Content Team	MITRE	Internal
2011-06-27	updated Common_Consequences
2012-05-11	CWE Content Team	MITRE	Internal
2012-05-11	updated Relationships
2012-10-30	CWE Content Team	MITRE	Internal
2012-10-30	updated Potential_Mitigations


	CWE is co-sponsored by the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. This Web site is sponsored and managed by The MITRE Corporation to enable stakeholder collaboration. Copyright © 2006-2014, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us

Common Weakness Enumeration

CWE-107: Struts: Unused Validation Form