VariantDraft
CWE-103Struts: Incomplete validate() Method Definition
Category: other
Description
The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().
Common consequences· 2
- Other — Unexpected State, Varies by ContextIf the code does not call super.validate(), the Validation Framework cannot check the contents of the form against a validation form. In other words, the validation framework will be disabled for the given form. Disabling the validation framework for a form exposes the product to numerous types of attacks.
- Confidentiality / Integrity / Availability / Other — OtherAlthough J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.
Potential mitigations· 1
- [Implementation]Implement the validate() method and call super.validate() within that method.
References
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.