CWE-104, Struts: Form Bean Does Not Extend Validation Class, applies when a form bean does not extend an ActionForm subclass of the Validator framework. MITRE says this can expose the application to other weaknesses related to insufficient input validation.
How it happens
The Struts Validator hooks into form beans through its own base classes. A bean that extends the plain ActionForm is outside that machinery, so rules defined in the validation configuration never apply to it.
// Vulnerable: plain ActionForm, the Validator never sees it
public class OrderForm extends ActionForm {
private String quantity;
// getters and setters
}
Everything may look correct. The rules exist, the mapping is in place, and the form still passes through unchecked.
What an attacker gains
MITRE says bypassing the validation framework for a form exposes the application to numerous attacks. Unchecked input is an important component of vulnerabilities like cross-site scripting, process control and SQL injection. It also repeats the note that, if the application calls native code without bounds checking, an input mistake in the Java layer can lead to a buffer overflow.
How to find it
MITRE says static analysis can find some instances. Search for classes that extend ActionForm directly and compare the list against your validation configuration.
How to fix it
Ensure that all forms extend one of the Validation classes.
// Fixed
public class OrderForm extends ValidatorForm {
private String quantity;
// getters and setters
}
Then confirm that a matching form entry exists in the validation configuration and that validate() still calls its parent.
Quick check
Why is a missing base class a security issue and not just style?
Without the Validator base class the framework never applies its rules to that form, so its fields reach your code unchecked.
