258
user will enter registration data and, through the Struts framework, the RegistrationForm bean will
maintain the user data.
Example Language: Java (Bad)
public class RegistrationForm extends org.apache.struts.action.ActionForm {
// private variables for registration form
private String name;
private String email;
...
public RegistrationForm() {
super();
}
// getter and setter methods for private variables
...
}
However, the RegistrationForm class extends the Struts ActionForm class which does use
the Struts validator plug-in to provide validator capabilities. In the following example, the
RegistrationForm Java class extends the ValidatorForm and Struts configuration XML file, strutsconfig.
xml, instructs the application to use the Struts validator plug-in.
Example Language: Java (Good)
public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {
// private variables for registration form
private String name;
private String email;
...
public RegistrationForm() {
super();
}
public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {...}
// getter and setter methods for private variables
...
}
The plug-in tag of the Struts configuration XML file includes the name of the validator plug-in to be
used and includes a set-property tag to instruct the application to use the file, validator-rules.xml,
for default validation rules and the file, validation.XML, for custom validation.
Example Language: XML (Good)
<struts-config>
<form-beans>
<form-bean name="RegistrationForm" type="RegistrationForm"/>
</form-beans>
...
<!-- ========================= Validator plugin ================================= -->
<plug-in className="org.apache.struts.validator.ValidatorPlugIn">
<set-property
property="pathnames"
value="/WEB-INF/validator-rules.xml,/WEB-INF/validation.xml"/>
</plug-in>
</struts-config>
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
CWE Version 4.14
CWE-107: Struts: Unused Validation Form
CWE-107: Struts: Unused Validation Form