While the syntax of an XPath expression is similar in many ways to an SQL query, XPath injection is more dangerous...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
than SQL injection. When Web applications construct XPath queries without first validating user-supplied data, XPath injections can exploit these applications. An attacker can inject data into a query, thereby changing its semantics. By inserting a series of Boolean queries – crafted expressions that produce a value of "true" or "false" – the attacker can iterate through all the nodes of the document. Using such techniques, even an attacker who has no prior knowledge of the XPath query can retrieve a complete XML database document.
Most databases provide some level of access and privilege controls, restricting users to certain tables, fields or queries. This restriction generally limits an attacker to the application's database account. XPath provides no access control for the database document, so an attacker can query all XML objects within it. Also, since XPath is a standard language, an attacker can create an automated attack to fit any XPath-based application. Because of SQL's many variants, SQL injection attacks must be customized for the particular version of SQL being targeted.
Measures taken to defend against SQL injection do in fact help protect against XPath injection. To review, here are a few preventative steps to take. First, your application must validate and sanitize all user input. Second, assume all data is from an un-trusted source; before it's used by your scripts, data access routines and XPath queries, validate the data for type, length, format and range. It's also worth noting that this validation must be performed on the server-side, not the client-side, since client-side validation is easily bypassed. Unfortunately, there isn't a native XPath equivalent to parameterized queries, and for that reason, XPath queries have to be constructed using string-building techniques. This makes validating user-supplied input all the more important. Testing whether your application is vulnerable to XPath injection is easy. Just add a single quotation mark within the data sent to your server, and see if an error occurs. If it does, then it's likely that an XPath injection is possible. The XPath 2.0 specification, which is in the final stages of the World Wide Web Consortium (W3C)'s approval process, offers a greatly expanded set of functions and capabilities, but sadly no increased security.
Dig Deeper on Web Services Security and SOA Security
Related Q&A from Michael Cobb
Is cookie encryption enough to protect sensitive information? Expert Michael Cobb explains how salted hashes can prevent attacks, and the secure way ...continue reading
A vulnerability was found in the Blackphone's Icera modem. Expert Michael Cobb explains how attackers could hijack the device, and if this would ...continue reading
Oracle is killing off the Java browser plug-in due to security risks. Expert Michael Cobb explains the next steps for enterprises with Java-based ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.