Description

Detects XPath injection vulnerabilities in Kotlin code where untrusted input is used in XPath queries without proper validation. This could allow attackers to manipulate XPath queries and potentially access unauthorized data from XML documents.

Detection Strategy

• Check if javax.xml.xpath library is imported in the codebase

• Identify calls to XPath query execution methods

• Determine if the XPath query string contains data from external/user input without proper sanitization

• Report vulnerability if unsanitized external input flows into XPath operations

Vulnerable code example

import javax.servlet.http.HttpServletRequest
import javax.xml.xpath.XPathFactory
import org.xml.sax.InputSource
import java.io.StringReader

fun vulnerableXPathQuery(request: HttpServletRequest) {
    val xmlDoc = "<users><user><name>admin</name><pass>secret</pass></user></users>"
    val xpath = XPathFactory.newInstance().newXPath()...

✅ Secure code example

import javax.servlet.http.HttpServletRequest
import javax.xml.xpath.XPathFactory
import javax.xml.xpath.XPathExpression
import javax.xml.xpath.XPathConstants
import org.xml.sax.InputSource
import java.io.StringReader

fun secureXPathQuery(request: HttpServletRequest) {...