Xpath Injection in Actix with Hmac Signatures

XPath Injection occurs when an attacker can influence an XPath expression used to query an XML document, enabling authentication bypass, data extraction, or logic manipulation. In Actix web applications that use XML for configuration or payload processing, developers sometimes sign XPath-related parameters with Hmac Signatures to ensure integrity. While Hmac Signatures protect against tampering, they do not prevent injection if the application builds XPath expressions using untrusted input before verification or uses the signature to convey user-controlled selectors.

Consider an endpoint that receives an XML document and an XPath selector, both covered by an Hmac Signature to prevent modification. If the server reconstructs the XPath from user input without sanitization—such as concatenating a user-supplied field into the expression—and then verifies the signature, the signature may still validate because the attacker’s input is part of the signed payload. This shifts trust from the signature to the application’s handling of the XPath. Attackers can inject wildcards, path traversals (e.g., //*), or predicate logic (e.g., //user[@id='1' or '1'='1']) to retrieve unintended nodes, bypass authorization checks, or cause denial of service through excessive node selection.

In an Actix service using Hmac Signatures, a typical flow might involve signing a JSON or form payload that includes XPath hints for downstream XML processing. If the service deserializes the payload, verifies the Hmac, and directly uses the provided XPath against an XML document without strict allowlisting, the signature offers false confidence. The signature confirms the parameters came from a client possessing the key, but it does not sanitize or validate the XPath content. This aligns with the BOLA/IDOR and Input Validation checks in middleBrick scans, where unchecked user control over query parameters leads to high-severity findings.

Moreover, if the Hmac is computed over serialized XML that includes embedded XPath expressions, and the application later parses that XML without isolating the XPath from the data context, attackers can embed malicious XML entities or external references, triggering SSRF or data exposure. middleBrick’s XML/SSRF and Data Exposure checks highlight such risks when XPath and signatures are intertwined without separation of concerns. The scanner tests whether an unauthenticated endpoint can be coerced into returning sensitive XML nodes via injected paths, demonstrating the practical impact of this design pattern.

middleBrick’s LLM/AI Security checks are not directly relevant here, but its Inventory Management and Unsafe Consumption checks can identify unsafe XML parsers and missing schema validation that exacerbate XPath Injection in Actix services using Hmac Signatures. Relying on the signature alone, without input validation and strict XPath construction, leaves the API vulnerable despite apparent integrity guarantees.

Remediation focuses on never trusting XPath expressions derived from client input, even when accompanied by a valid Hmac Signature. In Actix, implement strict allowlisting, parameterize queries, and validate structure before using Hmac verification as an integrity layer rather than an authorization layer.

First, define a strict schema for allowed XPath components. For example, permit only alphanumeric identifiers and predefined axes, and reject any user input containing //, /.., or wildcard characters unless explicitly required. Validate the XPath against this schema before any Hmac verification to ensure the content is safe irrespective of the signature.

Second, keep the Hmac over a canonical representation of data that does not include the XPath itself, or if it must include XPath, ensure the XPath is a discrete, validated token. Below is a Rust example using the hmac and sha2 crates in an Actix handler, where the XPath is selected from an allowlist and the signature covers only non-selector metadata:

use actix_web::{post, web, HttpResponse};
use hmac::{Hmac, Mac};
use sha2::Sha256;
use serde::{Deserialize, Serialize};

type HmacSha256 = Hmac;

#[derive(Deserialize)]
struct SafeQuery {
    /// Must be one of: "users_by_id", "active_users"
    selector: String,
    /// User-supplied parameter used in a parameterized query, not concatenated into XPath
    user_id: String,
    signature: String,
}

async fn verify_hmac(body: web::Json<SafeQuery>) -> HttpResponse {
    let secret = include_bytes!("/path/to/hmac_key");
    let mut mac = HmacSha256::new_from_slice(secret).expect("HMAC can take key of any size");
    // Canonical data excludes the selector or uses a validated token
    mac.update(b"users_by_id");
    // In practice, include a nonce/timestamp and validate freshness
    let result = mac.verify_final(&hex::decode(&body.signature).unwrap_or_default());
    if result.is_err() {
        return HttpResponse::BadRequest().body("Invalid signature");
    }
    // Map selector to a parameterized XPath safely
    let xpath = match body.selector.as_str() {
        "users_by_id" => format!("/users/user[id='{}']", xml_escape::encode_text(&body.user_id)),
        "active_users" => "/users/user[active='true']".to_string(),
        _ => return HttpResponse::BadRequest().body("Invalid selector"),
    }
    // Use a safe XML library to evaluate xpath with a compiled schema
    HttpResponse::Ok().body(xpath)
}

#[post("/query")]
async fn query_handler(body: web::Json<SafeQuery>) -> HttpResponse {
    verify_hmac(body).await
}

Third, if you must sign an XPath-bearing payload, separate the signing step: compute the Hmac over metadata (e.g., timestamp, session ID), validate the XPath against a schema, and only then combine it with the signed metadata for processing. This ensures the signature cannot be gamed by injecting malicious XPath fragments.

Finally, pair Hmac Signatures with runtime protections: use compiled XPath libraries with type-safe evaluation, enforce strict content-type and schema validation, and apply the middleware checks available in middleBrick’s Dashboard and CLI to detect residual injection risks. The Pro plan’s continuous monitoring can alert you if any endpoint begins accepting XPath-like parameters without allowlisting, while the GitHub Action can block merges if scans detect such patterns.