XPath injection (ARCH4108)

Key java.security.xpath-injection · Severity error · Category security · CWE CWE-643

Building an XPath expression by concatenating untrusted input lets attackers alter the query to disclose XML data they should not reach or bypass authentication.

Incorrect

String expr = "/users/user[name='" + name + "']";
XPathExpression xp = XPathFactory.newInstance().newXPath().compile(expr);

Correct

XPath xpath = XPathFactory.newInstance().newXPath();
xpath.setXPathVariableResolver(v -> name);
XPathExpression xp = xpath.compile("/users/user[name=$name]");

Fix

Use parameterized expressions with an XPath variable resolver; never concatenate input into the expression string.