Rule Definition
Every Action Form must have a corresponding validation form. If a Struts Action Form Mapping specifies a form, it must have a validation form defined under the Struts Validator.

Remediation
The source code below is the validate(..) method of the ExampleForm class. public ActionErrors validate( ActionMapping mapping, HttpServletRequest request) { ActionErrors actionErrors = new ActionErrors(); //Create a new instance of ActionErrors if(exampleForm.get("name").toString().length() < 3){ actionErrors.add(ActionErrors.GLOBAL_ERROR, new ActionError("error.name")); } //validate the properties of the DynaActionForm if(Integer.parseInt(exampleForm.get("age").toString()) < 1){ actionErrors.add(ActionErrors.GLOBAL_ERROR, new ActionError("error.age")); } return actionErrors; //return the actionErrors } Validation by XML file:

minlength 3 test (*this* > 18)

Violation Code Sample

<form-beans >
    <form-bean name="exampleForm" type="de.laliluna.tutorial.actionform.form.ExampleForm" />
</form-beans>


<action-mappings>
      <action
         attribute="exampleForm"
         input="/form/example.jsp"
         name="exampleForm"
         path="/example"
         scope="request"
         type="de.laliluna.tutorial.actionform.action.ExampleAction">

        <forward name="showExample" path="/form/example.jsp" />

    </action>
</action-mappings>

https://cwe.mitre.org/data/definitions/108.html