Rule Definition
Input validation is required to secure an application. Moreover, the web interface is exposed to anyone. Non validating input may allow injecting arbitrary web script, HTML, SQL... Consequences can be severe, like erasing the content of a database. Only one invalidated input can be exploited by an attacker. Note that unused fields should be constrained so that they can only be empty or undefined. If unused fields are not validated, shared business logic in an action may allow attackers to bypass the validation checks that are performed for other uses of the form.

Remediation
Validate each field of a form. When a form is shared among different action, you have to use the type org.apache.struts.validator.DynaValidatorActionForm for your Form Bean definition in the struts-config.xml file to be able to define a specific validation for each action.

Violation Code Sample

====>  For concrete Form Bean

--> logonForm.java (for concrete Form Bean) :
public class LogonForm extends ValidatorForm {
  private String username;
  private String password;
  
  public String getUsername() {
    return username;
  }
  
  public void setUsername(String username) {
    this.username = username;
  }

  public String getPassword() {
    return password;
  }

public void setPassword(String password) {
    this.password = password;
  }
}

--> struts-config.xml (for concrete Form Bean)
<form-beans>
  <form-bean name="logonForm"
            type="com.cast.struts.sample.LogonForm"/>
</form-beans>

====>  for dynamic Form Bean
--> struts-config.xml (for dynamic Form Bean)
<form-beans>
  <form-bean name="logonForm"
            type="org.apache
.struts.validator.DynaValidatorForm">
    <form-property name="username"
            type="java.lang.String"/>
    <form-property name="password"
            type="java.lang.String"/>
  </form-bean>
</form-beans>

====>  for both dynamic and concrete Form Bean

--> validation.xml:

<form-validation>
  <formset>
    <form name="logonForm"> // VIOLATION: password field is not validated
      <field property="username" 
            depends="required">
        <arg0 key="prompt.username"/>
      </field>
    </form>
  </formset>
</form-validation>

Fixed Code Sample

----> validation.xml:

<form-validation>
  <formset>
    <form name="logonForm">
      <field property="username" 
            depends="required">
        <arg0 key="prompt.username"/>
      </field>
      <field property="password" // FIXED
            depends="required">
        <arg0 key="prompt.password"/>
      </field>
    </form>
  </formset>
</form-validation>

http://cwe.mitre.org/data/definitions/105.html http://www.owasp.org/index.php/2004_Updates_OWASP_Top_Ten_Project