[STR-2347] [validator] enhance validator to be also able to validate request parameters/headers

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 1.2.4
• Component/s: Core
• Environment: Operating System: All; Platform: PC
• Bugzilla Id: 33268
• Assignee: Unassigned
• Reporter: Ralf Hauser
• Created: 27/Jan/05 19:59
• Updated: 17/Dec/08 03:53

Description

an important application programming security principle is to validate ALL
inputs (owasp.org).
request.getParameter() and request.getHeader(), getCookies(), getAttribute() may
bring many more values into an application than the validator.xml is capable to
validate.

--------------------
RFE: provide a way to also validate header/parameter/attribute fields
(beyond the maxFileSize controller that hopfully is applied also to them)
----------------

see also STR-1984 and STR-2332

P.S.: One might say that using any of those methods above is "bypassing" the
org.apache.struts.validator.ValidatorForm concept. If we want to avoid that
wouldn't it be the right approach according to the information-hiding principle
to remove the HttpServletRequest from the
org.apache.struts.action.Action.execute() method signature?
Probably, there would then be the need for a struts-controlled additional object
allowing validated access to cookies, etc.?