252
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Other
Other
Although J2EE applications are not generally susceptible
to memory corruption attacks, if a J2EE application
interfaces with native code that does not perform array
bounds checking, an attacker may be able to use an input
validation mistake in the J2EE application to launch a
buffer overflow attack.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Ensure that all forms extend one of the Validation Classes.
Demonstrative Examples
Example 1:
In the following Java example the class RegistrationForm is a Struts framework ActionForm Bean
that will maintain user information from a registration webpage for an online business site. The
user will enter registration data and through the Struts framework the RegistrationForm bean will
maintain the user data.
Example Language: Java (Bad)
public class RegistrationForm extends org.apache.struts.action.ActionForm {
// private variables for registration form
private String name;
private String email;
...
public RegistrationForm() {
super();
}
// getter and setter methods for private variables
...
}
However, the RegistrationForm class extends the Struts ActionForm class which does not allow the
RegistrationForm class to use the Struts validator capabilities. When using the Struts framework
to maintain user data in an ActionForm Bean, the class should always extend one of the validator
classes, ValidatorForm, ValidatorActionForm, DynaValidatorForm or DynaValidatorActionForm.
These validator classes provide default validation and the validate method for custom validation
for the Bean object to use for validating input data. The following Java example shows the
RegistrationForm class extending the ValidatorForm class and implementing the validate method
for validating input data.
Example Language: Java (Good)
public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {
// private variables for registration form
CWE Version 4.14
CWE-105: Struts: Form Field Without Validator
CWE-105: Struts: Form Field Without Validator