While the syntax of an XPath expression is similar in many ways to an SQL query, XPath injection is more dangerous...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
than SQL injection. When Web applications construct XPath queries without first validating user-supplied data, XPath injections can exploit these applications. An attacker can inject data into a query, thereby changing its semantics. By inserting a series of Boolean queries – crafted expressions that produce a value of "true" or "false" – the attacker can iterate through all the nodes of the document. Using such techniques, even an attacker who has no prior knowledge of the XPath query can retrieve a complete XML database document.
Most databases provide some level of access and privilege controls, restricting users to certain tables, fields or queries. This restriction generally limits an attacker to the application's database account. XPath provides no access control for the database document, so an attacker can query all XML objects within it. Also, since XPath is a standard language, an attacker can create an automated attack to fit any XPath-based application. Because of SQL's many variants, SQL injection attacks must be customized for the particular version of SQL being targeted.
Measures taken to defend against SQL injection do in fact help protect against XPath injection. To review, here are a few preventative steps to take. First, your application must validate and sanitize all user input. Second, assume all data is from an un-trusted source; before it's used by your scripts, data access routines and XPath queries, validate the data for type, length, format and range. It's also worth noting that this validation must be performed on the server-side, not the client-side, since client-side validation is easily bypassed. Unfortunately, there isn't a native XPath equivalent to parameterized queries, and for that reason, XPath queries have to be constructed using string-building techniques. This makes validating user-supplied input all the more important. Testing whether your application is vulnerable to XPath injection is easy. Just add a single quotation mark within the data sent to your server, and see if an error occurs. If it does, then it's likely that an XPath injection is possible. The XPath 2.0 specification, which is in the final stages of the World Wide Web Consortium (W3C)'s approval process, offers a greatly expanded set of functions and capabilities, but sadly no increased security.
Dig Deeper on Web Services Security and SOA Security
Related Q&A from Michael Cobb
Threat actors are moving from macro malware to using OLE technology to spread their malicious code. Expert Michael Cobb explains what enterprises ...continue reading
A digital signature on an HTML5 document cannot be authenticated the same way a PDF can. Expert Michael Cobb explains how enterprises should address ...continue reading
A survey found that half of its respondents perform application updates daily. Expert Michael Cobb explains how to allocate appropriate time on ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.