XPath Injection (ARCH8108)
Ce contenu n’est pas encore disponible dans votre langue.
Key kotlin.security.xpath-injection · Severity error · Category security · CWE CWE-643
Flags XPath expressions built with string templates from request data.
Incorrect
Section titled “Incorrect”xpath.evaluate("//user[@name='$name']", doc)Correct
Section titled “Correct”val expr = xpath.compile("//user[@name=$name]")xpath.setXPathVariableResolver { name }Bind values through an XPathVariableResolver instead of interpolating them.