What is Struts Unused Validation Form (CWE-107)?

TL;DR: CWE-107 flags a stale, unused entry in Struts’ validation.xml that no longer matches any active Action Form — not dangerous by itself, but a signal that the validation config as a whole may be out of date.

What is Struts Unused Validation Form?

Struts: Unused Validation Form (CWE-107) is a code-quality weakness that occurs when a validation form defined in an Apache Struts application’s validation.xml no longer has a corresponding, currently-active Action Form using it. As defined by the MITRE Corporation under CWE-107, this weakness has no official OWASP Top 10:2025 category mapping and is a direct child of both Irrelevant Code (CWE-1164) and Improper Input Validation (CWE-20).

Quick Summary

This isn’t an exploitable vulnerability in the traditional sense — an unused validation form has no attack surface on its own. Its real value is as a diagnostic signal: validation.xml files drift out of sync with the application’s actual Action Forms over time, and an unused entry proves that drift has already happened, which raises the odds that the more dangerous mirror-image problem — an active form with no validation at all — exists somewhere else in the same file.

Jump to: Quick Summary · Struts Unused Validation Form Overview · How Struts Unused Validation Form Works · Business Impact of Struts Unused Validation Form · Struts Unused Validation Form Attack Scenario · How to Detect Struts Unused Validation Form · How to Fix Struts Unused Validation Form · Framework-Specific Fixes for Struts Unused Validation Form · How to Ask AI to Check Your Code for Struts Unused Validation Form · Struts Unused Validation Form Best Practices Checklist · Struts Unused Validation Form FAQ · Vulnerabilities Related to Struts Unused Validation Form · References · Scan Your Own Site

Struts Unused Validation Form Overview

What: A form entry in validation.xml has no corresponding, currently-active Action Form mapping using it.

Why it matters: It’s direct evidence that validation configuration and application code have drifted apart, a state that commonly hides a more dangerous missing-validation gap elsewhere.

Where it occurs: Struts 1.x applications where validation.xml is maintained separately from struts-config.xml’s action mappings, and the two are not kept in sync during refactors.

Who is affected: Struts 1.x applications with a validation.xml file that hasn’t been audited against current action mappings recently.

Who is NOT affected: Applications where every validation.xml form entry is confirmed to map to a currently-active Action Form, verified as part of routine maintenance.

How Struts Unused Validation Form Works

Root Cause

An Action Form or its mapping was removed or renamed during development, but the corresponding entry in validation.xml was never cleaned up.

Attack Flow

1. A developer removes or renames an Action Form as part of a refactor, but forgets to update validation.xml.
2. The unused validation form entry remains in the file, no longer doing anything.
3. Over time, this kind of unmaintained drift accumulates, and the team’s confidence in validation.xml’s completeness erodes.
4. Separately, a new Action Form is added without a validation entry — the exact gap CWE-107’s presence was warning about — and that form now accepts unvalidated input, opening the door to injection or other input-driven attacks downstream.

Prerequisites to Exploit

• A validation.xml file exists with at least one form entry.
• That entry no longer maps to any currently-registered Action Form.
• The broader validation configuration has not been audited for corresponding gaps.

Vulnerable Code

<!-- validation.xml -->
<form-validation>
  <formset>
    <form name="legacyOrderForm">
      <field property="orderId" depends="required">
        <arg key="orderId"/>
      </field>
    </form>
  </formset>
</form-validation>

<!-- struts-config.xml: no action mapping references "legacyOrderForm" anymore -->
<action path="/order" type="com.example.OrderAction" name="orderForm" validate="true"/>

legacyOrderForm is defined in validation.xml but no <action> mapping in struts-config.xml references it, meaning it’s dead configuration — and its presence hides whether orderForm (the form actually in use) has its own complete validation entry.

Secure Code

<!-- validation.xml: dead entry removed, active form's validation confirmed present -->
<form-validation>
  <formset>
    <form name="orderForm">
      <field property="orderId" depends="required,integer">
        <arg key="orderId"/>
      </field>
    </form>
  </formset>
</form-validation>

The unused legacyOrderForm entry is removed, and the audit confirms orderForm — the form actually referenced by the active action mapping — has a real, current validation entry in place.

Business Impact of Struts Unused Validation Form

Quality Degradation: MITRE classifies the direct consequence of this weakness as quality degradation — stale configuration erodes confidence in the validation layer as a whole.

• Increases the likelihood that a genuinely-active form is missing validation elsewhere in the same file, unnoticed because the file “looks” maintained
• Adds maintenance burden and confusion for developers trying to understand which validation rules actually apply

Struts Unused Validation Form Attack Scenario

1. A development team refactors an order-processing feature, removing the old legacyOrderForm Action Form but leaving its validation.xml entry in place.
2. Later, a new developer adds a promoCodeForm Action Form for a new promotional feature, assuming validation.xml is comprehensive and skips adding validation for it.
3. Because promoCodeForm has no validation entry, user-submitted promo codes reach application logic unchecked.
4. An attacker submits a promo code value containing SQL injection syntax, and because no input validation ever ran, the injection succeeds.

How to Detect Struts Unused Validation Form

Manual Testing

• List every form name defined in validation.xml.
• List every Action Form currently referenced by an active mapping in struts-config.xml.
• Flag any validation.xml form with no matching active Action Form.

Automated Scanners (SAST / DAST)

Static analysis can directly cross-reference validation.xml form names against struts-config.xml action mappings to flag unused entries, since this is purely a configuration-matching check rather than something requiring runtime behavior to observe.

PenScan Detection

PenScan’s scanner engines cross-reference Struts Action Form mappings against validation.xml entries to flag stale or unused validation forms.

False Positive Guidance

A validation form intentionally kept for a soon-to-be-reactivated feature, or shared across multiple action paths via Struts’ form inheritance, may appear “unused” by a naive name-matching check — confirm the actual mapping relationships before removing an entry.

How to Fix Struts Unused Validation Form

• Remove the unused validation form entry from validation.xml.
• While auditing, check the reverse condition too — every active Action Form should have a corresponding validation entry (see CWE-108).
• Establish a routine check (manual or automated) that validation.xml and struts-config.xml stay in sync as the codebase evolves.

Framework-Specific Fixes for Struts Unused Validation Form

This weakness is specific to Apache Struts 1.x’s separate validation.xml configuration model; modern frameworks (Struts 2, Spring MVC, and others) handle validation differently (often via annotations co-located with the form class itself), so this exact drift pattern doesn’t apply there.

• Struts 1.x: remove unused <form> entries from validation.xml and cross-check against struts-config.xml’s <action> mappings, as shown above.

How to Ask AI to Check Your Code for Struts Unused Validation Form

Struts Unused Validation Form Best Practices Checklist

✅ Remove validation.xml entries with no corresponding active Action Form ✅ Audit for the reverse gap — active forms missing a validation entry ✅ Keep validation.xml and struts-config.xml in sync during refactors ✅ Establish a routine audit process rather than a one-time cleanup

Struts Unused Validation Form FAQ

How does an unused validation form indicate a real problem?

A validation form with no corresponding, currently-used Action Form means the validation.xml file has drifted out of sync with the actual application code, which is a strong signal that validation logic elsewhere may be similarly stale, incomplete, or missing for forms that actually matter.

How is this different from Struts: Unvalidated Action Form (CWE-108)?

CWE-107 is a form defined in validation.xml with no active Action Form using it (a stale leftover); CWE-108 is the opposite and more directly dangerous case — an active Action Form with no corresponding validation form defined at all.

How likely is this to be directly exploited according to MITRE?

MITRE does not associate this specific entry with a defined exploit likelihood, since an unused validation form itself has no attack surface — its risk is what it signals about the validation configuration’s overall currency and completeness.

How do I detect this in my own application?

Cross-reference every form defined in validation.xml against every currently-registered Action Form in struts-config.xml, and flag any validation form with no matching, active Action Form.

How do I fix this correctly?

Remove the unused validation form entry from validation.xml, and while doing so, audit the rest of the file for the reverse problem — active Action Forms missing their own validation entry.

How does this relate to general software quality, not just security?

MITRE classifies the direct consequence of this weakness as quality degradation rather than a security impact on its own — it is included in the CWE catalog because stale validation config is exactly the kind of drift that precedes real input-validation gaps.

How can PenScan help find this weakness?

PenScan cross-references Struts Action Form mappings against validation.xml entries to flag stale or unused validation forms during a scan.

Vulnerabilities Related to Struts Unused Validation Form

References

• MITRE - CWE-107
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find stale Struts validation configuration and other risks before an attacker does.