1487
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Unexpected State
Potential Mitigations
Phase: Implementation
The DTD or schema validation will not catch the duplicate occurrence of the same form name.
To find the issue in the implementation, manual checks or automated static analysis could be
applied to the xml configuration files.
Demonstrative Examples
Example 1:
These two Struts validation forms have the same name.
Example Language: XML (Bad)
<form-validation>
<formset>
<form name="ProjectForm"> ... </form>
<form name="ProjectForm"> ... </form>
</formset>
</form-validation>
It is not certain which form will be used by Struts. It is critically important that validation logic be
maintained and kept in sync with the rest of the product.
MemberOf Relationships
CWE Version 4.14
CWE-103: Struts: Incomplete validate() Method Definition
CWE-103: Struts: Incomplete validate() Method Definition