Skip to content

XPath Injection

Description

Passing untrusted user input in `xpath.parse()` can result in XPATH injection vulnerability. This could be abused by malicious actors to execute expressions on XML files to capture unauthorized information.

Examples

Insecure Code

javascript
xpath.parse(userInput)

Secure Code

javascript
const allowedExpr = ['expression1', 'expression2']; if (allowedExpr.includes(userInput)) { xpath.parse(userInput); }

Remediation

Always validate and sanitize user inputs, especially parameters or query strings that may influence the flow of the application. Use allowlists (lists of permitted expressions) to validate user input against known, trusted expressions before performing the parse.

Rule Details

FieldValue
IDCODE-0424
CategoryInjection
SeverityCRITICAL
CWECWE-643
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityEASY
Tagsxpath, injection
OWASPA1:2017-Injection, A03:2021-Injection