xpath-injection-anti-pattern

name	xpath-injection-anti-pattern
description	Security anti-pattern for XPath injection vulnerabilities (CWE-643). Use when generating or reviewing code that queries XML documents, constructs XPath expressions, or handles user input in XML operations. Detects unescaped quotes and special characters in XPath queries.

XPath Injection Anti-Pattern

Severity: High

Summary

XPath Injection occurs when applications insecurely embed user input into XPath queries without proper escaping or parameterization. XPath is used to navigate and query XML documents. Similar to SQL Injection, attackers can inject special characters into the input, manipulating the XPath query's logic. This can lead to authentication bypass, unauthorized access to sensitive XML data, or information disclosure about the XML document structure.

The Anti-Pattern

The anti-pattern is constructing XPath queries by concatenating user-controlled input directly into the XPath string without proper escaping or parameterization.

BAD Code Example

# VULNERABLE: User input is directly concatenated into an XPath query.
from lxml import etree

# Sample XML document
xml_doc = etree.fromstring('''
<users>
    <user>
        <name>admin</name>
        <password>adminpass</password>
        <role>administrator</role>
    </user>
    <user>
        <name>guest</name>
        <password>guestpass</password>
        <role>user</role>
    </user>
</users>
''')

def authenticate_user(username, password):
    # The XPath query is constructed using string concatenation.
    # Attacker can inject single quotes or boolean logic.
    xpath_query = f"//user[name='' and password='']"

    
    
    

    
    
    
    

    found_users = xml_doc.xpath(xpath_query)
     (found_users) >