CWE-103

Struts: Incomplete validate() Method Definition

Weakness Description

The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().

Potential Mitigations

Implementation

Implement the validate() method and call super.validate() within that method.

Common Consequences

Other
Unexpected StateVaries by Context

If the code does not call super.validate(), the Validation Framework cannot check the contents of the form against a validation form. In other words, the validation framework will be disabled for the given form. Disabling the validation framework for a form exposes the product to numerous types of attacks.

ConfidentialityIntegrityAvailabilityOther
Other

Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

Detection Methods

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Advertisement

Related Weaknesses