XPath injection (ARCH318)

Key dotnet.security.xpath-injection · Severity error · Category security · CWE CWE-643

Concatenating user input into an XPath expression lets an attacker alter the query and reach unauthorized nodes. Use variables.

Incorrect

var node = doc.SelectSingleNode(
    "/users/user[name='" + userName + "']");

Correct

var expr = nav.Compile("/users/user[name=$name]");
var ctx = new CustomContext(); // resolves $name to a bound value
expr.SetContext(ctx);
var node = nav.SelectSingleNode(expr);

Fix

Use XPathExpression variables/bound parameters instead of concatenating input as a string.