How to prevent XPath/XML injection in .NET

Question

How can I prevent XPATH injection in the .NET Framework?

We were previously using string concatenation to build XPATH statements, but found that end users could execute some arbitrary XPATH. For example:

string queryValue = "pages[@url='" + USER_INPUT_VALUE + "']";
node = doc.DocumentElement.SelectSingleNode(queryValue);

Would it be sufficient to strip out single and double quotes from input strings?

Or, does the .NET framework support parameterized XPATH queries?

Dimitre Novatchev · Accepted Answer · 2011-06-20 15:57:04Z

9

The main idea in preventing an XPath injection is to pre-compile the XPath expression you want to use and to allow variables (parameters) in it, which during the evaluation process will be substituted by user-entered values.

In .NET:

Have your XPath expresion pre-compiled with XPathExpression.Compile().
Use the XPathExpression.SetContext() Method to specify as context an XsltContext object that resolves some specific variables to the user-entered values.

You can read more about how to evaluate an XPath expression that contains variables here.

This text contains good and complete examples.

edited Jun 20, 2011 at 15:57

answered Jun 18, 2011 at 3:34

Dimitre Novatchev

244k27 gold badges308 silver badges438 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Serguei · Accepted Answer · 2011-06-17 05:42:58Z

2

Strongly typed parameters are available if you use a full-blown XsltTransform.

answered Jun 17, 2011 at 5:42

Serguei

2,9584 gold badges25 silver badges35 bronze badges

2 Comments

frankadelic Over a year ago

In my case, I am just trying to search for a node in an XML file. So XSLT is overkill.

Dimitre Novatchev Over a year ago

Strongly typed parameters are possible not only using an XSLT transformation -- see my answer.

Michael Kay · Accepted Answer · 2011-06-17 10:13:16Z

1

Parameterized XPath is possible if you use Saxon as your XPath processor.

answered Jun 17, 2011 at 10:13

Michael Kay

165k11 gold badges97 silver badges173 bronze badges

Comments

Emond · Accepted Answer · 2011-06-17 06:09:21Z

0

Instead of strongly typed parameters you could decrease the options for a user. Why give them full control if you do not want that?

Provide the user with a couple of option to select from and then create the query.

Allowing the user to enter any string is asking for trouble or a lot of work.

answered Jun 17, 2011 at 6:09

Emond

50.8k11 gold badges86 silver badges118 bronze badges

4 Comments

frankadelic Over a year ago

What you're suggesting sounds like sanitizing input. Can you provide the set of characters which must be filtered for XPATH?

Dimitre Novatchev Over a year ago

@frankadelic: You don't need "a set of characters" at all. The way to protect from an XPath injection is to use a pre-compiled XPath expressions that contains variables. See my answer for explanation and links to the relevant .NET documentation.

Emond Over a year ago

Yes, that is what I meant. Do not allow string input. Give some option buttons and check boxes and hard code the queries.

frankadelic Over a year ago

Thanks, however, in my use case I cannot reduce the input choice to a set of options. If that were the case, I would use a whitelist approach.

Collectives™ on Stack Overflow

How to prevent XPath/XML injection in .NET

4 Answers 4

Comments

2 Comments

Comments

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

2 Comments

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related