250
}
public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {
ActionErrors errors = new ActionErrors();
if (getName() == null || getName().length() < 1) {
errors.add("name", new ActionMessage("error.name.required"));
}
return errors;
}
// getter and setter methods for private variables
...
}
Although the validate method is implemented in this example the method does not call the validate
method of the ValidatorForm parent class with a call super.validate(). Without the call to the parent
validator class only the custom validation will be performed and the default validation will not be
performed. The following example shows that the validate method of the ValidatorForm class is
called within the implementation of the validate method.
Example Language: Java (Good)
public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {
// private variables for registration form
private String name;
private String email;
...
public RegistrationForm() {
super();
}
public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {
ActionErrors errors = super.validate(mapping, request);
if (errors == null) {
errors = new ActionErrors();
}
if (getName() == null || getName().length() < 1) {
errors.add("name", new ActionMessage("error.name.required"));
}
return errors;
}
// getter and setter methods for private variables
...
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Notes
Relationship
This could introduce other weaknesses related to missing input validation.
Maintenance
The current description implies a loose composite of two separate weaknesses, so this node
might need to be split or converted into a low-level category.
Taxonomy Mappings
CWE Version 4.14
CWE-104: Struts: Form Bean Does Not Extend Validation Class
CWE-104: Struts: Form Bean Does Not Extend Validation Class