ActionForm class should contain only private fields which are accessed by setter and getter. Creating non-private fields violated this contract and has introduced the possibility of avoiding validation and creating an invalid state for the Form object.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Make all fields private. Use getter to get the value of the field. Setter should be used only by the framework; setting an action form field from other actions is bad practice and should be avoided.

Example 1

10 public class SV_STRUTS_PRIVATE_Sample_1 extends ActionForm {
11     private String name;
12     protected String birthdayString;
13     public String getName() {
14         return name;
15     }
16     public void setName(String name) {
17         this.name = name;
18     }
19     public String getBirthday() {
20         return birthdayString;
21     }
22     public void setBirthday(String birthday) {
23         this.birthdayString = birthday;
24     }
25 }

SV.STRUTS.PRIVATE is reported for field declaration on line 12: Struts: Form field 'birthdayString' should be private