CWE - 103 : Struts: Incomplete validate() Method Definition
|
CWE Definition
|
http://cwe.mitre.org/data/definitions/103.html
|
|
Number of vulnerabilities:
|
0
|
|
Description
|
The application has a validator form that either fails to
define a validate() method, or defines a validate() method but fails to call
super.validate().If you do not call super.validate(), the Validation Framework cannot check
the contents of the form against a validation form. In other words, the
validation framework will be disabled for the given form. |
|
Background Details
|
The Struts Validator uses a form's validate() method to check the contents
of the form properties against the constraints specified in the associated
validation form. That means the following classes have a validate() method
that is part of the validation framework: ValidatorForm,
ValidatorActionForm, DynaValidatorForm, and DynaValidatorActionForm. If you
create a class that extends one of these classes, and if your class
implements custom validation logic by overriding the validate() method, you
must call super.validate() in your validate() implementation. |
|
Other Notes
|
|
|
|
Warning! CWE definitions are provided as a quick reference. They are
not complete and may not be up to date!
You must visit
http://cwe.mitre.org/ for a complete list of CWE entries
and for more details.
