264
validate="false">
</action>
This mapping has disabled validation. Disabling validation exposes this action to numerous types of
attacks.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1406 Comprehensive Categorization: Improper Input
Validation
1400 2531
Notes
Other
The Action Form mapping in the demonstrative example disables the form's validate() method.
The Struts bean: write tag automatically encodes special HTML characters, replacing a < with
"&lt;" and a > with "&gt;". This action can be disabled by specifying filter="false" as an attribute of
the tag to disable specified JSP pages. However, being disabled makes these pages susceptible
to cross-site scripting attacks. An attacker may be able to insert malicious scripts as user input to
write to these JSP pages.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Struts: Validator Turned Off
Software Fault Patterns SFP24 Tainted input to command
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-110: Struts: Validator Without Form Field
Weakness ID : 110
Structure : Simple
Abstraction : Variant
Description
Validation fields that do not appear in forms they are associated with indicate that the validation
logic is out of date.
Extended Description
It is easy for developers to forget to update validation logic when they make changes to an
ActionForm class. One indication that validation logic is not being properly maintained is
inconsistencies between the action form and the validation form.
Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE
application interfaces with native code that does not perform array bounds checking, an attacker
CWE Version 4.14
CWE-110: Struts: Validator Without Form Field
CWE-110: Struts: Validator Without Form Field