XPath Injection (ARCH8108)

Key kotlin.security.xpath-injection · Severity error · Category security · CWE CWE-643

Flags XPath expressions built with string templates from request data.

Incorrect

xpath.evaluate("//user[@name='$name']", doc)

Correct

val expr = xpath.compile("//user[@name=$name]")
xpath.setXPathVariableResolver { name }

Fix

Bind values through an XPathVariableResolver instead of interpolating them.