While the syntax of an XPath expression is similar in many ways to an SQL query, XPath injection is more dangerous...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
than SQL injection. When Web applications construct XPath queries without first validating user-supplied data, XPath injections can exploit these applications. An attacker can inject data into a query, thereby changing its semantics. By inserting a series of Boolean queries – crafted expressions that produce a value of "true" or "false" – the attacker can iterate through all the nodes of the document. Using such techniques, even an attacker who has no prior knowledge of the XPath query can retrieve a complete XML database document.
Most databases provide some level of access and privilege controls, restricting users to certain tables, fields or queries. This restriction generally limits an attacker to the application's database account. XPath provides no access control for the database document, so an attacker can query all XML objects within it. Also, since XPath is a standard language, an attacker can create an automated attack to fit any XPath-based application. Because of SQL's many variants, SQL injection attacks must be customized for the particular version of SQL being targeted.
Measures taken to defend against SQL injection do in fact help protect against XPath injection. To review, here are a few preventative steps to take. First, your application must validate and sanitize all user input. Second, assume all data is from an un-trusted source; before it's used by your scripts, data access routines and XPath queries, validate the data for type, length, format and range. It's also worth noting that this validation must be performed on the server-side, not the client-side, since client-side validation is easily bypassed. Unfortunately, there isn't a native XPath equivalent to parameterized queries, and for that reason, XPath queries have to be constructed using string-building techniques. This makes validating user-supplied input all the more important. Testing whether your application is vulnerable to XPath injection is easy. Just add a single quotation mark within the data sent to your server, and see if an error occurs. If it does, then it's likely that an XPath injection is possible. The XPath 2.0 specification, which is in the final stages of the World Wide Web Consortium (W3C)'s approval process, offers a greatly expanded set of functions and capabilities, but sadly no increased security.
Dig Deeper on Web Services Security and SOA Security
Related Q&A from Michael Cobb
An old Java vulnerability was discovered to have been ineffectually patched. Expert Michael Cobb explains how this happened and what can be done to ...continue reading
Google's Certificate Transparency tool publicly logs certificates issued by CAs. Expert Michael Cobb explains how the log viewer works to improve ...continue reading
Crowning the most secure web browser is difficult, with research often turning up biased results. Expert Michael Cobb explains how to make a choice ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.