SV.XPATH
This error is detected when unchecked user input is used as an XPath expression.
As of release 2023.2, this checker supports Jakarta EE.
Mitigation and prevention
The prevention of XPath injection attacks can be achieved by validating any and all input from outside the application (user input, file input, system parameters, etc.). The best way to filter user data is with a blacklist regular expression that includes only the type of characters that are allowed; all other characters should be escaped.
Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.
Example 1
protected void doGet(HttpServletRequest httpServletRequest,
HttpServletResponse httpServletResponse) throws ServletException, IOException {
super.doGet(httpServletRequest, httpServletResponse);
String userName = httpServletRequest.getParameter("user.name");
String userDescr = httpServletRequest.getParameter("user.descr");
CompiledExpression compiledExpression = JXPathContext.compile("string(//user[name/text()='" + userName + "']/account/text())");
compiledExpression.setValue(context, userDescr);
httpServletResponse.getOutputStream().println("User info updated");
}SV.XPATH is reported for the snippet twice:
- user data is stored in 'userName' on line 27 and later is used for the construction of an XPath expression on line 29
- user data is stored in 'userDescr' on line 28 and later is passed to 'setValue(...)' on line 30
External guidance
Extension
This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.
