CWE-110, Struts: Validator Without Form Field, flags validation fields that do not appear in the forms they are associated with. MITRE reads this as evidence that the validation logic is out of date.
How it happens
It is easy for developers to forget to update validation logic when they change an ActionForm class. A property is renamed or removed in the Java bean, and the old field entry stays in the validation configuration.
<form name="accountForm">
<field property="phoneNumber" depends="required,mask"/>
<!-- bean property was renamed to mobileNumber, so the rule above checks nothing -->
</form>
The renamed property now has no rule, and the leftover rule validates a field that does not exist.
What an attacker gains
MITRE says it is critically important that validation logic be kept in sync with the rest of the application. Unchecked input is the root cause of some of today's worst and most common software security problems, including cross-site scripting, SQL injection and process control. A stale rule is how a field becomes unchecked without anyone deciding it should.
How to find it
MITRE says manual checks or automated static analysis can be applied to the XML configuration files, and rates this method as moderately effective. A script that compares each form's property names with the bean's fields will find mismatches in both directions.
How to fix it
Update the validation form so its field entries match the current bean: remove entries for properties that no longer exist, and add rules for new or renamed ones. Run the comparison script in your build so drift is caught when it happens.
Quick check
What does a rule for a missing field tell you?
That validation configuration was not updated after a change to the form, so a replacement field may be going unchecked.
