CWE-102, Struts: Duplicate Validation Forms, applies to Java applications that use the Struts Validator. The product defines multiple validation forms with the same name, and the Validator may validate a form the programmer does not expect.
How it happens
In Struts, validation rules live in XML, typically in validation.xml. Each rule set is a form entry with a name. When two entries share a name, MITRE explains, the Struts Validator arbitrarily chooses one to use for input validation and discards the other.
<form name="registerForm">
<field property="email" depends="required,email"/>
</form>
<!-- Added later by someone else, same name -->
<form name="registerForm">
<field property="username" depends="required,maxlength"/>
</form>
One of these wins and the other is silently dropped. Which one depends on the Validator, not on you. Whichever fields lived in the losing form are now unchecked.
MITRE also points to the bigger signal: duplicates indicate that the validation logic is not up to date, and can indicate that other, more subtle validation errors are present.
What an attacker gains
MITRE lists the consequence as integrity, with the application ending up in an unexpected state. In practice, fields you believed were validated reach your business logic unchecked, which opens the door to the usual input weaknesses.
How to find it
MITRE notes that DTD or schema validation will not catch a duplicate occurrence of the same form name, because the file is still valid XML. To find it, apply manual checks or automated static analysis to the XML configuration files. A simple script that lists every name attribute on form elements and flags repeats will do.
How to fix it
Merge the duplicate entries into one form that contains every field you intend to validate, delete the extra, and re-test the form with both sets of inputs. Treat the duplicate as a prompt to review the whole file for drift.
Quick check
Why will schema validation not catch this?
Two form elements with the same name are still well formed, valid XML. The problem is semantic, so you need a check that compares names.
