263
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-109: Struts: Validator Turned Off
Weakness ID : 109
Structure : Simple
Abstraction : Variant
Description
Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and
custom validation logic. This exposes the application to other weaknesses related to insufficient
input validation.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1173 Improper Use of Validation Framework 1969
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Potential Mitigations
Phase: Implementation
Ensure that an action form mapping enables validation. Set the validate field to true.
Demonstrative Examples
Example 1:
This mapping defines an action for a download form:
Example Language: XML (Bad)
<action path="/download"
type="com.website.d2.action.DownloadAction"
name="downloadForm"
scope="request"
input=".download"
CWE Version 4.14
CWE-110: Struts: Validator Without Form Field
CWE-110: Struts: Validator Without Form Field