249
Background Details
The Struts Validator uses a form's validate() method to check the contents of the form properties
against the constraints specified in the associated validation form. That means the following
classes have a validate() method that is part of the validation framework: ValidatorForm,
ValidatorActionForm, DynaValidatorForm, and DynaValidatorActionForm. If the code creates
a class that extends one of these classes, and if that class implements custom validation
logic by overriding the validate() method, the code must call super.validate() in the validate()
implementation.
Common Consequences
Scope Impact Likelihood
Other Other
Disabling the validation framework for a form exposes the
product to numerous types of attacks. Unchecked input
is the root cause of vulnerabilities like cross-site scripting,
process control, and SQL injection.
Confidentiality
Integrity
Availability
Other
Other
Although J2EE applications are not generally susceptible
to memory corruption attacks, if a J2EE application
interfaces with native code that does not perform array
bounds checking, an attacker may be able to use an input
validation mistake in the J2EE application to launch a
buffer overflow attack.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Implement the validate() method and call super.validate() within that method.
Demonstrative Examples
Example 1:
In the following Java example the class RegistrationForm is a Struts framework ActionForm Bean
that will maintain user input data from a registration webpage for an online business site. The user
will enter registration data and the RegistrationForm bean in the Struts framework will maintain the
user data. Tthe RegistrationForm class implements the validate method to validate the user input
entered into the form.
Example Language: Java (Bad)
public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {
// private variables for registration form
private String name;
private String email;
...
public RegistrationForm() {
super();
CWE Version 4.14
CWE-103: Struts: Incomplete validate() Method Definition
CWE-103: Struts: Incomplete validate() Method Definition