Struts: Incomplete validate() Method Definition

Opis

The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().

Skutki

• Other

  Unexpected State; Varies by Context

  If the code does not call super.validate(), the Validation Framework cannot check the contents of the form against a validation form. In other words, the validation framework will be disabled for the given form. Disabling the validation framework for a form exposes the product to numerous types of attacks.

• Confidentiality, Integrity, Availability, Other

  Other

  Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

Zapobieganie

• Implementation

  Implement the validate() method and call super.validate() within that method.

Słabość nadrzędna

• CWE-573 Improper Following of Specification by Caller
• CWE-20 Improper Input Validation

Kiedy powstaje

• Implementation

Dotyczy

Java

Uwagi

This could introduce other weaknesses related to missing input validation.

The current description implies a loose composite of two separate weaknesses, so this node might need to be split or converted into a low-level category.

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005