Rule Definition
Input validation is required to secure an application. Moreover, the web interface is exposed to anyone. Non validating input may allow injecting arbitrary web script, HTML, SQL... Consequences can be severe, like erasing the content of a database. Only one invalidated input can be exploited by an attacker. Note that unused fields should be constrained so that they can only be empty or undefined. If unused fields are not validated, shared business logic in an action may allow attackers to bypass the validation checks that are performed for other uses of the form.

Remediation
Validate each field of the action class referenced in the methods of the action class called by the Struts framework. You can do it either by implementing the validate() method of the com.opensymphony.xwork2.ActionSupport class (or com.opensymphony.xwork2.Validateable interface) or by updating the 'Action class'-validation.xml file.

Violation Code Sample

==> with the validate() method
public class Register extends ActionSupport {
  private String username;
  private String password; /* VIOLATION: the password is not referenced in the validate() method */

  public String execute(){
    User user = new User();
    user.setPassword( getPassword() );
    user.setUsername( getUsername() );
    session.put(Constants.USER, user);
    return SUCCESS;
  }

  public void validate(){ /* VIOLATION: the password is not referenced in this method */
    if ( getUsername().length() == 0 ){
      addFieldError( "username", getText("username.required") );
    }
    if (getUsers().userExists(getUsername() ) ){
      addFieldError("username", getText( "user.exists"));
    }
  }
}

==> with the validation.xml file:
public class Register extends ActionSupport {
  private String username;
  private String password; /* VIOLATION: the password is not referenced in Register-validation.xml */

  public String execute(){
    User user = new User();
    user.setPassword( getPassword() );
    user.setUsername( getUsername() );
    session.put(Constants.USER, user);
    return SUCCESS;
  }
}

Register-validation.xml
<validators>
  <field name="username">
      <field-validator type="requiredstring">
           <message >Username is required.</message>
      </field-validator>
      <field-validator type="stringlength">
         <param name="maxLength">8</param>
         <param name="minLength">5</param>
         <message>While ${username} is a nice name, a valid username must be between ${minLength} and ${maxLength} characters long. </message>
     </field-validator>
  </field>
</validators>

Fixed Code Sample

public class Register extends ActionSupport {
  private String username;
  private String password;

  public String execute(){
    User user = new User();
    user.setPassword( getPassword() );
    user.setUsername( getUsername() );
    session.put(Constants.USER, user);
    return SUCCESS;
  }

  public void validate(){ /* FIXED: the password is referenced in this method */
    if ( getUsername().length() == 0 ){
      addFieldError( "username", getText("username.required") );
    }

 if ( getPassword().length() == 0 ){
   addFieldError( "password", getText("password.required") );
    }
 
    if (getUsers().userExists(getUsername() ) ){
      addFieldError("username", getText( "user.exists"));
    }
  }
}

==> with the validation.xml file:
public class Register extends ActionSupport {
  private String username;
  private String password; /* FIXED: the password referenced in the Register-validation.xml file (2 times) */ 

  public String execute(){
    User user = new User();
    user.setPassword( getPassword() );
    user.setUsername( getUsername() );
    session.put(Constants.USER, user);
    return SUCCESS;
  }
}

Register-validation.xml
<validators>
  <field name="password">
      <field-validator type="requiredstring">
         <message >Password is required.</message>
      </field-validator>
      <field-validator type="stringlength">
         <param name="maxLength">10</param>
         <param name="minLength">6</param>
         <message>Your password should be 6-10 characters.</message>
      </field-validator>
  </field>
  <field name="username">
      <field-validator type="requiredstring">
           <message >Username is required.</message>
      </field-validator>
      <field-validator type="stringlength">
         <param name="maxLength">8</param>
         <param name="minLength">5</param>
         <message>While ${username} is a nice name, a valid username must be between ${minLength} and ${maxLength} characters long. </message>
     </field-validator>
  </field>
  <validator type="expression">
      <param name="expression">username != password</param>
      <message>Username and password can't be the same.</message>
  </validator>
</validators>

http://www.owasp.org/index.php/2004_Updates_OWASP_Top_Ten_Project