Struts: Validator Turned Off

Opis

Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.

Skutki

• Access Control

  Bypass Protection Mechanism

Zapobieganie

• Implementation

  Ensure that an action form mapping enables validation. Set the validate field to true.

Słabość nadrzędna

• CWE-1173 Improper Use of Validation Framework
• CWE-20 Improper Input Validation

Kiedy powstaje

• Implementation

Dotyczy

Java

Uwagi

The Action Form mapping in the demonstrative example disables the form's validate() method. The Struts bean: write tag automatically encodes special HTML characters, replacing a < with "&lt;" and a > with "&gt;". This action can be disabled by specifying filter="false" as an attribute of the tag to disable specified JSP pages. However, being disabled makes these pages susceptible to cross-site scripting attacks. An attacker may be able to insert malicious scripts as user input to write to these JSP pages.

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005