120 lines
4.0 KiB
Plaintext
120 lines
4.0 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
// === javax.xml.xpath.XPath ===
|
|
import javax.xml.namespace.QName;
|
|
import javax.xml.xpath.XPath;
|
|
|
|
import org.xml.sax.InputSource;
|
|
|
|
class M {
|
|
void foo(XPath xpath, String expression, InputSource source, QName returnType, Object item) throws Exception {
|
|
xpath.compile(expression); // Sensitive
|
|
xpath.evaluate(expression, source); // Sensitive
|
|
xpath.evaluate(expression, source, returnType); // Sensitive
|
|
xpath.evaluate(expression, item); // Sensitive
|
|
xpath.evaluate(expression, item, returnType); // Sensitive
|
|
}
|
|
}
|
|
----
|
|
|
|
----
|
|
// === Apache XML Security ===
|
|
import org.apache.xml.utils.PrefixResolver;
|
|
import org.apache.xml.security.utils.XPathAPI;
|
|
import org.w3c.dom.Node;
|
|
|
|
class M {
|
|
void foo(XPathAPI api, Node contextNode, String str, Node namespaceNode, PrefixResolver prefixResolver,
|
|
Node xpathnode) throws Exception {
|
|
api.evaluate(contextNode, xpathnode, str, namespaceNode); // Sensitive
|
|
api.selectNodeList(contextNode, xpathnode, str, namespaceNode); // Sensitive
|
|
}
|
|
}
|
|
----
|
|
|
|
----
|
|
// === Apache Xalan ===
|
|
import org.apache.xml.utils.PrefixResolver;
|
|
import org.apache.xpath.XPathAPI;
|
|
import org.w3c.dom.Node;
|
|
|
|
class M {
|
|
void foo(XPathAPI api, Node contextNode, String str, Node namespaceNode, PrefixResolver prefixResolver)
|
|
throws Exception {
|
|
XPathAPI.eval(contextNode, str); // Sensitive
|
|
XPathAPI.eval(contextNode, str, namespaceNode); // Sensitive
|
|
XPathAPI.eval(contextNode, str, prefixResolver); // Sensitive
|
|
XPathAPI.selectNodeIterator(contextNode, str); // Sensitive
|
|
XPathAPI.selectNodeIterator(contextNode, str, namespaceNode); // Sensitive
|
|
XPathAPI.selectNodeList(contextNode, str); // Sensitive
|
|
XPathAPI.selectNodeList(contextNode, str, namespaceNode); // Sensitive
|
|
XPathAPI.selectSingleNode(contextNode, str); // Sensitive
|
|
XPathAPI.selectSingleNode(contextNode, str, namespaceNode); // Sensitive
|
|
}
|
|
}
|
|
----
|
|
|
|
----
|
|
// === org.apache.commons.jxpath ===
|
|
import org.apache.commons.jxpath.JXPathContext;
|
|
|
|
abstract class A extends JXPathContext{
|
|
A(JXPathContext compilationContext, Object contextBean) {
|
|
super(compilationContext, contextBean);
|
|
}
|
|
|
|
|
|
void foo(JXPathContext context, String str, Object obj, Class<?> requiredType) {
|
|
JXPathContext.compile(str); // Sensitive
|
|
this.compilePath(str); // Sensitive
|
|
context.createPath(str); // Sensitive
|
|
context.createPathAndSetValue(str, obj); // Sensitive
|
|
context.getPointer(str); // Sensitive
|
|
context.getValue(str); // Sensitive
|
|
context.getValue(str, requiredType); // Sensitive
|
|
context.iterate(str); // Sensitive
|
|
context.iteratePointers(str); // Sensitive
|
|
context.removeAll(str); // Sensitive
|
|
context.removePath(str); // Sensitive
|
|
context.selectNodes(str); // Sensitive
|
|
context.selectSingleNode(str); // Sensitive
|
|
context.setValue(str, obj); // Sensitive
|
|
}
|
|
}
|
|
----
|
|
|
|
== See
|
|
|
|
* OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
|
|
* CWE - https://cwe.mitre.org/data/definitions/643[CWE-643 - Improper Neutralization of Data within XPath Expressions]
|
|
* https://wiki.sei.cmu.edu/confluence/x/cDZGBQ[CERT, IDS53-J.] - Prevent XPath Injection
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 17 Sep 2018, 18:55:00 Nicolas Harraudeau wrote:
|
|
Note: JXPath is a little different as it targets Beans and other objects but it should be as vulnerable.
|
|
|
|
=== on 9 May 2019, 15:59:45 Nicolas Harraudeau wrote:
|
|
This rule is deprecated for Java because it is handled by the taint analysis engine (RSPEC-2091).
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|