XPath injection (ARCH3108)

Key typescript.security.xpath-injection · Severity error · Category security · CWE CWE-643

Concatenating untrusted input into an XPath expression lets attackers alter the query to bypass authorization or disclose data.

Incorrect

import { select } from "xpath";

function findUser(doc: Node, name: string) {
  // name="' or '1'='1"
  return select(`//user[@name='${name}']`, doc);
}

Correct

import xpath from "xpath";

function findUser(doc: Node, name: string) {
  const expr = xpath.parse("//user[@name=$name]");
  return expr.select({ node: doc, variables: { name } });
}

Fix

Use variable binding; never concatenate input into the XPath string.