Description

Detects potential XML XPath injection vulnerabilities in C# code where untrusted input is used in XML node operations without proper sanitization. This can allow attackers to manipulate XPath queries and potentially access unauthorized XML data.

Detection Strategy

• Check if System.Xml namespace is imported in the code

• Look for calls to XML navigation methods (like SelectNodes, SelectSingleNode) on XMLNode objects

• Verify if the first parameter to these methods contains user-controllable input

• Confirm the input parameter is not properly sanitized or validated

• Report a vulnerability if unsafe data flows into XML query operations

Vulnerable code example

using System.Xml;

public class XPathInjectionExample
{
    public string GetUserData(string username, string password)
    {
        XmlDocument xmlDoc = new XmlDocument();
        xmlDoc.Load("users.xml");...

✅ Secure code example

using System.Xml;
using System.Xml.XPath;

public class XPathInjectionExample
{
    public string GetUserData(string username, string password)
    {
        XmlDocument xmlDoc = new XmlDocument();...