XPath injection (ARCH6108)

Key ruby.security.xpath-injection · Severity error · Category security · CWE CWE-643

Concatenating untrusted input into an XPath expression lets attackers alter the query to disclose unauthorized data or bypass authentication.

Incorrect

def find(user)
  doc.xpath("//user[name='#{user}']")
end

Correct

def find(user)
  doc.xpath("//user[name=$name]", nil, name: user)
end

Fix

Do not embed input in XPath; use variable binding (xpath parameters).