Struts Misconfiguration: Missing Action Input

Java/JSP

Abstract

忽略可能返回验证错误的指定 Struts 操作的 input 属性会导致错误。

Explanation

Struts 规范要求每当指定操作返回验证错误时都提供 input 属性[2]。input 属性指定发生验证错误时用于显示错误消息的页面。
示例 1：以下配置定义指定验证操作，但未指定 input 属性。


<action-mappings>
  <action   path="/Login"
            type="com.LoginAction"
            name="LoginForm"
            scope="request"
            validate="true" />
</action-mappings>

References

[1] Apache Struts Specification

[2] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[3] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[4] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[5] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[6] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[7] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[8] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

desc.config.java.struts_misconfiguration_missing_action_input