1421
Properly validate user input. Reject data where appropriate, filter where appropriate and escape
where appropriate. Make sure input that will be used in XPath queries is safe in that context.
Demonstrative Examples
Example 1:
Consider the following simple XML document that stores authentication information and a snippet
of Java code that uses XPath query to retrieve authentication information:
Example Language: XML (Informative)
<users>
<user>
<login>john</login>
<password>abracadabra</password>
<home_dir>/home/john</home_dir>
</user>
<user>
<login>cbc</login>
<password>1mgr8</password>
<home_dir>/home/cbc</home_dir>
</user>
</users>
The Java code used to retrieve the home directory based on the provided credentials is:
Example Language: Java (Bad)
XPath xpath = XPathFactory.newInstance().newXPath();
XPathExpression xlogin = xpath.compile("//users/user[login/text()='" + login.getUserName() + "' and password/text() = '" +
login.getPassword() + "']/home_dir/text()");
Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new File("db.xml"));
String homedir = xlogin.evaluate(d);
Assume that user "john" wishes to leverage XPath Injection and login without a valid password. By
providing a username "john" and password "' or ''='" the XPath expression now becomes
Example Language: (Attack)
//users/user[login/text()='john' or ''='' and password/text() = '' or ''='']/home_dir/text()
This lets user "john" login without a valid password, thus bypassing authentication.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 929 OWASP Top Ten 2013 Category A1 - Injection 928 2389
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Relationship
CWE Version 4.14
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax