CWE-608: Struts: Non-private Field in ActionForm Class
Struts: Non-private Field in ActionForm Class
Weakness ID: 608 (Weakness Variant)
Status: Draft
Description
Description Summary
An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.
Time of Introduction
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Integrity
Confidentiality
Technical Impact: Modify application
data; Read application
data
Demonstrative Examples
Example 1
In the following Java example the class RegistrationForm is a Struts
framework ActionForm Bean that will maintain user input data from a
registration webpage for a online business site. The user will enter
registration data and through the Struts framework the RegistrationForm bean
will maintain the user data.
(Bad Code)
Example
Language: Java
public class RegistrationForm extends
org.apache.struts.validator.ValidatorForm {
// variables for registration form
public String name;
public String email;
...
public RegistrationForm() {
super();
}
public ActionErrors validate(ActionMapping mapping,
HttpServletRequest request) {...}
...
}
However, within the RegistrationForm the member variables for the
registration form input data are declared public not private. All member
variables within a Struts framework ActionForm class must be declared
private to prevent the member variables from being modified without
using the getter and setter methods. The following example shows the
member variables being declared private and getter and setter methods
declared for accessing the member variables.
(Good Code)
Example
Language: Java
public class RegistrationForm extends
org.apache.struts.validator.ValidatorForm {
// private variables for registration form
private String name;
private String email;
...
public RegistrationForm() {
super();
}
public ActionErrors validate(ActionMapping mapping,
HttpServletRequest request) {...}
// getter and setter methods for private variables
...
}
Potential Mitigations
Make all fields private. Use getter to get the value of the field.
Setter should be used only by the framework; setting an action form
field from other actions is bad practice and should be avoided.
Weakness Ordinalities
Ordinality
Description
Primary
(where
the weakness exists independent of other weaknesses)
Description
