XPath Injection Anti-Pattern

Severity: High

Summary

XPath Injection occurs when applications insecurely embed user input into XPath queries without proper escaping or parameterization. XPath is used to navigate and query XML documents. Similar to SQL Injection, attackers can inject special characters into the input, manipulating the XPath query's logic. This can lead to authentication bypass, unauthorized access to sensitive XML data, or information disclosure about the XML document structure.

The Anti-Pattern

The anti-pattern is constructing XPath queries by concatenating user-controlled input directly into the XPath string without proper escaping or parameterization.

BAD Code Example

# VULNERABLE: User input is directly concatenated into an XPath query.
from lxml import etree

# Sample XML document