AWS logo
Amazon CodeGuruDetector Library

XPath injection High

Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways. This might grant the attacker access to any data, not just the data that the original query intended.

Detector ID
javascript/xpath-injection@v1.0
Category
Common Weakness Enumeration (CWE) external icon

Noncompliant example

1var express = require('express')
2var xpath = require('xpath')
3var dom = require('xmldom').DOMParser
4var app = express()
5function xpathInjectionNoncompliant() {
6    app.get('www.example.com', function(req, res) {
7        var userName = req.params.userName
8        var xml = "<book><title>Harry Potter</title></book>"
9        var doc = new dom().parseFromString(xml)
10        // Noncompliant: passing user-input directly in an XPath expression.
11        var nodes = xpath.select("//title" + userName, doc)
12    })
13}

Compliant example

1var express = require('express')
2var xpath = require('xpath')
3var dom = require('xmldom').DOMParser
4var app = express()
5function xpathInjectionCompliant()
6{
7    app.get('www.example.com', function(req, res) {
8        var userName = req.params.userName
9        var xml = "<book><title>Harry Potter</title></book>"
10        var doc = new dom().parseFromString(xml)
11        // Compliant: passing sanitized user-input in an XPath expression.
12        var nodes = xpath.select("//title" + escape(userName), doc)
13    })
14}