What is the best way to avoid XPath Injection attack in Java?

Question

I am using XPath to retrieve values from XML. My code scanner break the build because of the following reason:

invokes an XPath query built using unvalidated input. This call could allow an attacker to modify the statement's meaning or to

This is my code:

private String myMethod(String XPath, OMElement input) {
  String elementText = null;
  AXIOMXPath xpathToElement = null;
  try {
    xpathToElement = new AXIOMXPath(XPath);
    xpathToElement.addNamespace(xxx,yyy);
    elementText = ((OMElement) xpathToElementnode.selectSingleNode(input)).getText();

  } catch (JaxenException e) {
    e.printStackTrace();
    fail(e.getMessage());
  ...

Here is the code where I call above method:

key = myMethod(myAttribute.getAttributeValue(), input);

input is OMelement which contains XML. Attribute is getting from XML attribute.

How can I avoid XPathInjection? Could please share a code snippet?

You don't show the calls to `myMethod()`. If user input can reach the first argument to `myMethod()`, you are at risk. — kjhughes, May 21 '15 at 02:49

score 0 · Answer 1 · edited May 23 '17 at 11:58

0

You're taking an entire XPath from user input or other external source?

Recommendation: Do not take in a full XPath expression an unsecured source. Use precompiled XPaths. If you have to parameterize your XPath based on user input, isolate the user-based parts to string-only parameters, and then use your XPath library's parameterization mechanism.

You're using Java and Axiom, which is based on Jaxen, so use SimpleVariableContext and setVariableContext() for XPath parameterization. See Charles Duffy's answer here for more details on safely parameterizing XPaths when using Axiom.

edited May 23 '17 at 11:58

Community

1
1

answered May 21 '15 at 12:20

kjhughes

106,133
27
181
240

I am getting the xpath as whole text and it doesn't contain any parameters. My xpath is like `//a/b[x=y]/d`. – user2694734 May 21 '15 at 14:13
Can you not embed such a fixed XPath in the code you control such that it can be precompiled? – kjhughes May 21 '15 at 14:20

What is the best way to avoid XPath Injection attack in Java?

1 Answers1