XPath injection (ARCH2108)

Key python.security.xpath-injection · Severity error · Category security · CWE CWE-643

Concatenating untrusted input into an XPath expression lets an attacker alter the query and access unauthorized data. Use variable binding.

Incorrect

from lxml import etree

def find_user(tree, name):
    return tree.xpath("//user[@name='" + name + "']")

Correct

from lxml import etree

def find_user(tree, name):
    return tree.xpath("//user[@name=$n]", n=name)

Fix

Use XPath variable binding (parameters) instead of embedding input into the expression.