Struts: Plug-in Framework Not In Use - Revision history

KirstenS at 22:56, 7 April 2009

2009-04-07T22:56:06Z

KirstenS at 00:59, 18 February 2009

2009-02-18T00:59:06Z

KirstenS at 00:37, 6 November 2008

2008-11-06T00:37:19Z

KirstenS at 00:09, 1 October 2008

2008-10-01T00:09:34Z

Jeff Williams: /* Description */

2008-03-20T04:36:01Z

‎Description

Weilin Zhong: /* Categories */

2006-07-24T18:20:56Z

‎Categories

Weilin Zhong: Contents provided by Fortify.

2006-07-24T18:19:45Z

Contents provided by Fortify.

Weilin Zhong at 19:38, 16 June 2006

2006-06-16T19:38:26Z

New page

{{Template:Vulnerability}}

==Description==

==Examples ==

==Related Threats==

==Related Attacks==

==Related Vulnerabilities==

==Related Countermeasures==

==Categories==

{{Template:Stub}}

[[Category:Input Validation Vulnerability]]

[[Category:Struts]]

← Older revision		Revision as of 22:56, 7 April 2009
Line 3:		Line 3:
	#REDIRECT [[Improper Data Validation]]		#REDIRECT [[Improper Data Validation]]

−
−	~~__TOC__~~
−
−	~~[[ASDR Table of Contents]]~~

@@ Line 1: / Line 1: @@
-{{Template:Vulnerability}}
+{{template:CandidateForDeletion}}
-{{Template:Fortify}}
 __TOC__
@@ Line 9: / Line 11: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==
@@ Line 65: / Line 64: @@
 __NOTOC__

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+__TOC__
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
@@ Line 71: / Line 72: @@
 [[Category:Java]]
 [[Category:Implementation]]

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 ==Description==
 Unchecked input is the leading cause of vulnerabilities in J2EE applications. Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others. Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.
@@ Line 18: / Line 26: @@
 * Free-form strings are of a reasonable length and composition
-==Related Attacks==
+==Risk Factors==
-==Related Vulnerabilities==
+TBD
-[[:Category:Input Validation]]
+__NOTOC__
 [[Category:Input Validation Vulnerability]]
 [[Category:Struts]]
 [[Category:Java]]
 [[Category:Implementation]]

@@ Line 10: / Line 10: @@
 Unchecked input is the leading cause of vulnerabilities in J2EE applications. Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others. Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.
-To prevent such attacks, use the Struts Validator to check all program input before it is processed by the application. Use the Fortify Source Code Analysis Engine to ensure that there are no holes in your configuration of the Struts Validator.
+To prevent such attacks, use the Struts Validator to check all program input before it is processed by the application.
 Example uses of the validator include checking to ensure that:
@@ Line 16: / Line 16: @@
 * Phone number fields contain only valid characters in phone numbers
 * Boolean values are only "T" or "F"
 * Free-form strings are of a reasonable length and composition
 ==Examples ==