58 lines
1.3 KiB
Plaintext
58 lines
1.3 KiB
Plaintext
According to the Common Weakness Enumeration,
|
|
|
|
____
|
|
If two validation forms have the same name, the Struts Validator arbitrarily chooses one of the forms to use for input validation and discards the other. This decision might not correspond to the programmer's expectations...
|
|
____
|
|
|
|
|
|
In such a case, it is likely that the two forms should be combined. At the very least, one should be removed.
|
|
|
|
|
|
== Noncompliant Code Example
|
|
|
|
[source,xml]
|
|
----
|
|
<form-validation>
|
|
<formset>
|
|
<form name="BookForm"> ... </form>
|
|
<form name="BookForm"> ... </form> <!-- Noncompliant -->
|
|
</formset>
|
|
</form-validation>
|
|
----
|
|
|
|
|
|
== Compliant Solution
|
|
|
|
[source,xml]
|
|
----
|
|
<form-validation>
|
|
<formset>
|
|
<form name="BookForm"> ... </form>
|
|
</formset>
|
|
</form-validation>
|
|
----
|
|
|
|
|
|
== See
|
|
|
|
* https://cwe.mitre.org/data/definitions/102[MITRE, CWE-102] - Struts: Duplicate Validation Forms
|
|
* https://owasp.org/www-community/vulnerabilities/Improper_Data_Validation[OWASP, Improper Data Validation] - Struts: Duplicate Validation Forms
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::message.adoc[]
|
|
|
|
include::highlighting.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::comments-and-links.adoc[]
|
|
endif::env-github,rspecator-view[]
|