Struts Misconfiguration: Missing Form Bean

Java/JSP

Abstract

指向不存在 form-bean 的 Struts action 將無法正確對應。

Explanation

Struts 使用 form-bean 項目進行 HTML 型式與動作的對應。如果 <action> 標籤中的 name 屬性無法與 form-bean 的名稱對應，就無法對應該動作，並且表示該項目為不必要的定義或拼字錯誤。

範例 1：以下組態不包含 bean2 的對應。


<form-beans>
  <form-bean name="bean1" type="coreservlets.UserFormBean" />
</form-beans>

<action-mappings>
  <action path="/actions/register1" type="coreservlets.RegisterAction1" name="bean1" scope="request" />
  <action path="/actions/register2" type="coreservlets.RegisterAction2" name="bean2" scope="request" />
</action-mappings>

References

[1] Apache Struts 1.3 Specification

[2] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[3] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[4] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[5] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[6] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention

[7] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention

[8] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention

desc.config.java.struts_misconfiguration_missing_form_bean