Rule Definition
If two validation forms have the same name, the Struts Validator arbitrarily chooses one of the forms to use for input validation and discards the other. This decision might not correspond to the programmer's expectations, possibly leading to resultant weaknesses. Moreover, it indicates that the validation logic is not up-to-date, and can indicate that other, more subtle validation errors are present.

Remediation
Remove the duplicate struts validation form.

Violation Code Sample

Two validation forms with the same name.


<form-validation>
    <formset>
        <form name="LoginForm">
            <field property="userName" depends="required">
                <arg key="LoginForm.userName"/>
            </field>
            <field property="password" depends="required,minlength">
                <arg0 key="LoginForm.password"/>
                <arg1 key="${var:minlength}" name="minlength" resource="false"/><br>
                <var>
                <var-name>minlength</var-name>
                <var-value>6</var-value>
                </var>
            </field>
        </form>
       <form name="LoginForm"> // Violation 
            <field property="userPhone" depends="required">
                <arg key="LoginForm.userPhone"/>
            </field>
            ......
        </form>
    </formset>
</form-validation>

Fixed Code Sample

<form-validation>
    <formset>
        <form name="LoginForm1">
            <field property="userName" depends="required">
                <arg key="LoginForm1.userName"/>
            </field>
            <field property="password" depends="required,minlength">
                <arg0 key="LoginForm1.password"/>
                <arg1 key="${var:minlength}" name="minlength" resource="false"/><br>
                <var>
                <var-name>minlength</var-name>
                <var-value>6</var-value>
                </var>
            </field>
        </form>
       <form name="LoginForm2"> // FIXED
            <field property="userPhone" depends="required">
                <arg key="LoginForm2.userPhone"/>
            </field>
            ......
        </form>
    </formset>
</form-validation>

https://cwe.mitre.org/data/definitions/102.html https://www.owasp.org/index.php/Improper_Data_Validation#Struts:_Duplicate_Validation_Forms https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration