rspec/rules/S3374/xml/rule.adoc

Having two form validation entries with the same name indicates a configuration
issue. Only one of the two configurations will be applied, which can lead to
validation gaps.

== Why is this an issue?

In Struts, form validation is used to validate the data the application's
clients provide as part of a form submission to the server. Configuring two
different form validations with the same name leads to unexpected behaviors.

When faced with multiple form validations with the same name, Struts will
arbitrarily choose one and apply it while discarding the others.

=== What is the potential impact?

The application might perform an incomplete validation of user-submitted forms.
Some parts of the validation configuration defined in discarded items will not
apply, which can have severe consequences if not duplicated in the applied one.

Missing input validation can make the application vulnerable to injection
attacks or other severe issues. They might affect the confidentiality,
integrity, or availability of the application or the data it stores.

== How to fix it

=== Code examples

==== Noncompliant code example

[source,xml,diff-id=1,diff-type=noncompliant]
----
<form-validation>
  <formset>
    <form name="BookForm"> ... </form>
    <form name="BookForm"> ... </form>  <!-- Noncompliant -->
  </formset>
</form-validation>
----


==== Compliant solution

[source,xml,diff-id=1,diff-type=compliant]
----
<form-validation>
  <formset>
    <form name="BookForm"> ... </form>
  </formset>
</form-validation>
----

=== How does this work?

Only one validation configuration should remain. Depending on what was
previously configured, one should either remove the useless validation entries 
or merge all of them into a single complete one.

== Resources

=== Standards

* CWE - https://cwe.mitre.org/data/definitions/102[CWE-102 - Struts: Duplicate Validation Forms]

=== Documentation

* Struts Documentation - https://svn.apache.org/repos/asf/struts/struts1/tags/STRUTS_1_1_B1/contrib/validator/docs/overview.html[Struts Validator]
* OWASP - https://owasp.org/www-community/vulnerabilities/Improper_Data_Validation[Improper Data Validation]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

Rename this form; line x holds another form declaration with the same name.


=== Highlighting

* primary: second instance of form name
* secondary: original instance of form name
** message: original


'''
== Comments And Links
(visible only on this page)

=== on 12 Oct 2015, 14:49:34 Ann Campbell wrote:
in ``++validation.xml++``

=== on 19 Mar 2018, 11:04:46 Sébastien GIORIA - AppSecFR wrote:
According to [CWE-102], is a member of A1:2017 Injection.

=== on 29 May 2018, 17:07:01 Alexandre Gigleux wrote:
\[~SPoint] CWE-102 is saying "OWASP Top Ten 2004 Category A1 - Unvalidated Input" and there is no longer a category for "Unvalidated Input".

endif::env-github,rspecator-view[]