CWE-109: Struts: Validator Turned Off
Description
Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.
Submission Date :
July 19, 2006, midnight
Modification Date :
2023-06-29 00:00:00+00:00
Organization :
MITRE
Example - 1
This mapping defines an action for a download form:
<action path="/download"type="com.website.d2.action.DownloadAction"name="downloadForm"scope="request"input=".download"validate="false"></action>This mapping has disabled validation. Disabling validation exposes this action to numerous types of attacks.
Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.