界: Input Validation and Representation

輸入驗證和表示法問題是由中繼字元、替代編碼和數值表示法引起的。信任輸入會導致安全問題。問題包括：「Buffer Overflows」、「Cross-Site Scripting」攻擊、「SQL Injection」及其他許多問題。

Struts: Unused Action Form

Java/JSP

Abstract

Unused Action Form 表示其應用程式邏輯是過時的。

Explanation

Struts 使用 form-bean 項目進行 HTML 型式與動作的對應。如果 Struts 組態設定檔案的 <action-mappings> 元素不包含對應經由 <form-bean> 標籤所定義的相關操作表單的項目，應用程式邏輯可能已過時。

範例 1：以下組態不包含 bean2 的對應。


<form-beans>
  <form-bean name="bean1" type="coreservlets.UserFormBean1" />
  <form-bean name="bean2" type="coreservlets.UserFormBean2" />
</form-beans>

<action-mappings>
  <action path="/actions/register1" type="coreservlets.RegisterAction1" name="bean1" scope="request" />
</action-mappings>

References

[1] Apache Struts 1.3 Specification

[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001310

[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[5] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[6] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[7] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[8] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[9] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[10] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[11] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[12] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[13] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002530 CAT II

[14] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002530 CAT II

[15] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.config.java.struts_unused_action_form