rspec/rules/S6399/common/fix/code-rationale.adoc

The following code is an example of an overly simple authentication function:
The role of a user is set in an XML file and the default user role is `user`. +
This example code is vulnerable to an XML injection vulnerability because it
builds an XML string from user input without prior sanitation or validation.

In this particular case, the query can be exploited with the following string: 

----
attacker</username><role>admin</role></user>
<user><username>foo
----

By adapting and inserting this string into the `username` field, an attacker
would be able to log in as an admin.