XPath Injection (ARCH5108)

Key go.security.xpath-injection · Severity error · Category security · CWE CWE-643

An XPath expression assembled from input (xpath.Compile, htmlquery.FindOne(doc, ...), xmlquery.Find) lets the caller rewrite the query - ' or '1'='1 selects every node.

Incorrect

expr := fmt.Sprintf("//user[@name='%s']", name)
node := htmlquery.FindOne(doc, expr)

Correct

if !validName.MatchString(name) {
  return ErrBadName
}
node := htmlquery.FindOne(doc, "//user[@name='"+strings.ReplaceAll(name, "'", "")+"']")

Fix

Validate the value against an allowlist pattern before it enters the expression, or select by a literal path and compare attributes in Go.