1969
Nature Type ID Name Page
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
CWE-1173: Improper Use of Validation Framework
Weakness ID : 1173
Structure : Simple
Abstraction : Base
Description
The product does not use, or incorrectly uses, an input validation framework that is provided by the
source language or an independent library.
Extended Description
Many modern coding languages provide developers with input validation frameworks to make the
task of input validation easier and less error-prone. These frameworks will automatically check all
input against specified criteria and direct execution to error handlers when invalid input is received.
The improper use (i.e., an incorrect implementation or missing altogether) of these frameworks
is not directly exploitable, but can lead to an exploitable condition if proper input validation is not
performed later in the product. Not using provided input validation frameworks can also hurt the
maintainability of code as future developers may not recognize the downstream input validation
being used in the place of the validation framework.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
ParentOf 102 Struts: Duplicate Validation Forms 246
ParentOf 105 Struts: Form Field Without Validator 253
ParentOf 106 Struts: Plug-in Framework not in Use 256
ParentOf 108 Struts: Unvalidated Action Form 261
ParentOf 109 Struts: Validator Turned Off 263
ParentOf 554 ASP.NET Misconfiguration: Not Using Input Validation
Framework