Improper Restriction of XML External Entity Reference ('XXE')
ID |
scala.xpathi.scala_xpathi_rule_xpathinjection |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Xpathi |
Language |
Scala |
Description
The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection.
Rationale
The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection.
The following code illustrates a vulnerable pattern detected by this rule:
object PermissionLookup {
@throws[Exception]
def lookup(args: Array[String]): Unit = {
val catalogue: Document = null
val role = args(1)
val query = "//roles/role[@name='" + role + "']/canWrite/text()"
// VULNERABLE: Improper Restriction of XML External Entity Reference ('XXE')
XPathFactory.newInstance.newXPath.evaluate(query, catalogue)
// VULNERABLE: Improper Restriction of XML External Entity Reference ('XXE')
System.out.println("granted=" + XPathFactory.newInstance.newXPath.evaluate(query, catalogue))
// Compiling the expression is enough: the injection is already in the string.
// VULNERABLE: Improper Restriction of XML External Entity Reference ('XXE')
XPathFactory.newInstance.newXPath.compile(query)
XPathFactory.newInstance.newXPath.compile("//roles/role[@name='auditor']/canWrite/text()")
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A05 : Injection.