Struts Misconfiguration: Missing Forward Path

Abstract

沒有 path 屬性的 <forward> 標籤通常表示 leftover debug code 或拼字錯誤。

Explanation

<forward> 標籤必須有 name 和 path 屬性。省略路徑或指定一個空白路徑皆視為錯誤。此外，所有路徑都必需以「/」字元開頭。

範例 1：以下 <forward> 標籤缺少 path 屬性。


    <forward name="success" />

References

[1] Apache Struts 1.3 Specification

[2] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[3] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[4] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[5] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[6] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

desc.config.java.struts_misconfiguration_missing_forward_path