1362
user will enter registration data and through the Struts framework the RegistrationForm bean will
maintain the user data.
Example Language: Java (Bad)
public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {
// variables for registration form
public String name;
public String email;
...
public RegistrationForm() {
super();
}
public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {...}
...
}
However, within the RegistrationForm the member variables for the registration form input data are
declared public not private. All member variables within a Struts framework ActionForm class must
be declared private to prevent the member variables from being modified without using the getter
and setter methods. The following example shows the member variables being declared private
and getter and setter methods declared for accessing the member variables.
Example Language: Java (Good)
public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {
// private variables for registration form
private String name;
private String email;
...
public RegistrationForm() {
super();
}
public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {...}
// getter and setter methods for private variables
...
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1002 SFP Secondary Cluster: Unexpected Entry Points 888 2421
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP28 Unexpected access points
CWE-609: Double-Checked Locking
Weakness ID : 609
Structure : Simple
Abstraction : Base
Description
The product uses double-checked locking to access a resource without the overhead of explicit
synchronization, but the locking is insufficient.
CWE Version 4.14
CWE-609: Double-Checked Locking
CWE-609: Double-Checked Locking