Mandiant Struts Forms

These forms simple forms illustrate the different ways that one can implement input validation in Apache Struts applications.

• mandiant-struts-form-vulnerable - Version of the form vulnerable to Reflected Cross Site Scripting
• mandiant-struts-form-incomplete-blacklist - Version of the form that uses incomplete black list input validation to prevent "<script>" tags, but is vulnerable to more sophisticated types of Reflected Cross Site Scripting
• mandiant-struts-validatorform - Version of the form that uses the Struts ValidatorForm to implement a white list
• mandiant-struts-validatorform-with-javascript - Version of the form that uses the Struts ValidatorForm to implement a white list on the server and on the client in JavaScript
These forms were contributed by MANDIANT