Rule Definition
Input validation is required to secure an application. Moreover, the web interface is exposed to anyone. Non validating input may allow injecting arbitrary web script, HTML, SQL... Consequences can be severe, like erasing the content of a database.

Remediation
Update your application's struts-config.xml file with the Validator plugin declaration.

Violation Code Sample

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE struts-config PUBLIC "-//Apache Software Foundation//DTD Struts  Configuration 1.3//EN" "http://struts.apache.org/dtds/struts-config_1_3.dtd"> <struts-config>     <form-beans>         <form-bean name="loginForm" type="form.LoginForm" />         <form-bean name="adminForm" type="form.AdminForm"></form-bean>     </form-beans>     <action-mappings>         <action input="/login.jsp" name="loginForm" path="/login"              type="action.LoginAction" scope="session" >             <forward name="successStudent" path="/student.do" redirect="true" />         </action>         <action input="/admin.jsp" name="adminForm" path="/admin"  type="action.AdminAction">             <forward name="success" path="/admin.jsp"></forward>         </action>             </action-mappings>     <message-resources parameter="action.ApplicationResources" />  </struts-config>

Fixed Code Sample

Add the following lines in your application's struts-config.xml file:

<!-- Validator Configuration -->
<plug-in className="org.apache.struts.validator.ValidatorPlugIn">
  <set-property property="pathnames"               value="/technology/WEB-INF/validator-rules.xml, /WEB-INF/validation.xml"/>
</plug-in>

Upon initialization, the plug-in loads the comma-delimited list of Validator config files specified by the pathnames property. Each config file's path should be specified by use of a Web application-relative path.

http://cwe.mitre.org/data/definitions/106.html