CWE-103 - Struts: Incomplete validate() Method Definition
- 摘要：Variant
- 结构：Simple
- 状态：Draft
- 发布日期：2006-07-19
- 更新日期：2025-12-11
名称
Struts: Incomplete validate() Method Definition
描述
The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().
常见后果
范围：Other
影响：Unexpected State, Varies by Context
注释：If the code does not call super.validate(), the Validation Framework cannot check the contents of the form against a validation form. In other words, the validation framework will be disabled for the given form. Disabling the validation framework for a form exposes the product to numerous types of attacks.
范围：Confidentiality, Integrity, Availability, Other
影响：Other
注释：Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.