266
public void setStartDate(String startDate) {
this.startDate = startDate;
}
public void setEndDate(String endDate) {
this.endDate = endDate;
}
}
This second block of related code shows a validation form with a third field: scale. The presence of
the third field suggests that DateRangeForm was modified without taking validation into account.
Example Language: XML (Bad)
<form name="DateRangeForm">
<field property="startDate" depends="date">
<arg0 key="start.date"/>
</field>
<field property="endDate" depends="date">
<arg0 key="end.date"/>
</field>
<field property="scale" depends="integer">
<arg0 key="range.scale"/>
</field>
</form>
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Struts: Validator Without Form Field
Software Fault Patterns SFP24 Tainted input to command
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-111: Direct Use of Unsafe JNI
Weakness ID : 111
Structure : Simple
Abstraction : Variant
Description
When a Java application uses the Java Native Interface (JNI) to call code written in another
programming language, it can expose the application to weaknesses in that code, even if those
weaknesses cannot occur in Java.
Extended Description
CWE Version 4.14
CWE-111: Direct Use of Unsafe JNI
CWE-111: Direct Use of Unsafe JNI