XPath injection via user-controlled input
ID |
vbnet.inject.xpath_injection |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Inject |
Language |
VB.NET |
Description
User-controlled input flows into an XPath expression without neutralization, which may allow XPath injection to read or bypass parts of the XML document. Use a parameterized XPath API (XPathExpression with XsltArgumentList / variables) or strictly validate the input instead of building the expression by concatenation.
Rationale
User-controlled input flows into an XPath expression without neutralization, which may allow XPath injection to read or bypass parts of the XML document. Use a parameterized XPath API (XPathExpression with XsltArgumentList / variables) or strictly validate the input instead of building the expression by concatenation.
The following code illustrates a vulnerable pattern detected by this rule:
Public Sub SelectNodesFromQueryString(ByVal Request As HttpRequest, ByVal doc As XmlDocument)
Dim user As String = Request.QueryString("user")
' VULNERABLE: XPath injection via user-controlled input
Dim nodes = doc.SelectNodes("/users/user[name='" & user & "']")
End SubRemediation
Follow secure coding practices and review the references below for detailed remediation guidance.