265
may be able to use an input validation mistake in the J2EE application to launch a buffer overflow
attack.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1164 Irrelevant Code 1967
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Other
It is critically important that validation logic be maintained
and kept in sync with the rest of the application.
Unchecked input is the root cause of some of today's worst
and most common software security problems. Cross-site
scripting, SQL injection, and process control vulnerabilities
all stem from incomplete or absent input validation.
Detection Methods
Automated Static Analysis
To find the issue in the implementation, manual checks or automated static analysis could be
applied to the XML configuration files.
Effectiveness = Moderate
Manual Static Analysis
To find the issue in the implementation, manual checks or automated static analysis could be
applied to the XML configuration files.
Effectiveness = Moderate
Demonstrative Examples
Example 1:
This example shows an inconsistency between an action form and a validation form. with a third
field.
This first block of code shows an action form that has two fields, startDate and endDate.
Example Language: Java (Bad)
public class DateRangeForm extends ValidatorForm {
String startDate, endDate;
CWE Version 4.14
CWE-111: Direct Use of Unsafe JNI
CWE-111: Direct Use of Unsafe JNI