257
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1173 Improper Use of Validation Framework 1969
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Unexpected State
Potential Mitigations
Phase: Architecture and Design
Strategy = Input Validation
Use an input validation framework such as Struts.
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use an input validation framework such as Struts.
Phase: Implementation
Strategy = Input Validation
Use the Struts Validator to validate all program input before it is processed by the application.
Ensure that there are no holes in the configuration of the Struts Validator. Example uses of the
validator include checking to ensure that: Phone number fields contain only valid characters in
phone numbers Boolean values are only "T" or "F" Free-form strings are of a reasonable length
and composition
Phase: Implementation
Strategy = Libraries or Frameworks
Use the Struts Validator to validate all program input before it is processed by the application.
Ensure that there are no holes in the configuration of the Struts Validator. Example uses of the
validator include checking to ensure that: Phone number fields contain only valid characters in
phone numbers Boolean values are only "T" or "F" Free-form strings are of a reasonable length
and composition
Demonstrative Examples
Example 1:
In the following Java example the class RegistrationForm is a Struts framework ActionForm Bean
that will maintain user input data from a registration webpage for an online business site. The
CWE Version 4.14
CWE-106: Struts: Plug-in Framework not in Use
CWE-106: Struts: Plug-in Framework not in Use