Xpath Injection in Adonisjs

Xpath injection in Adonisjs occurs when user-supplied data is directly interpolated into Xpath queries without proper sanitization. Unlike SQL injection which targets databases, Xpath injection exploits XML path expressions used in XML databases, configuration files, or when Adonisjs applications process XML data.

The most common scenario in Adonisjs applications involves using the xml2js library or similar XML processing tools where developers construct Xpath queries dynamically. Consider this vulnerable Adonisjs controller code:

const { HttpContextContract } = require('@adonisjs/core/HttpContext')
const { DOMParser } = require('xmldom')

class UserController {
  async findByUsername({ request }) {
    const username = request.input('username')
    
    // VULNERABLE: Direct interpolation of user input
    const xpath = `/users/user[username='${username}']`
    
    const xml = `
      <users>
        <user>
          <username>admin</username>
          <password>hashed_password</password>
        </user>
        <user>
          <username>test</username>
          <password>hashed_password</password>
        </user>
      </users>
    `
    
    const doc = new DOMParser().parseFromString(xml)
    const nodes = doc.evaluate(xpath, doc, null, 0, null)
    
    // Process results...
  }
}

An attacker could exploit this by submitting username=admin' or '1'='1, causing the Xpath to become:

/users/user[username='admin' or '1'='1']

This returns all users because '1'='1' is always true. More dangerous payloads like admin' and password/text()='admin123 can extract specific user data.

Another Adonisjs-specific pattern involves using the xml-query package with dynamic queries:

const { xmlQuery } = require('xml-query')

const query = xmlQuery(xmlDoc)
  .find(`//user[username='${username}']`)
  .value()

The same injection principles apply, and since Adonisjs often handles authentication and user data, Xpath injection can lead to credential exposure or privilege escalation.

Detecting Xpath injection in Adonisjs requires both static code analysis and runtime scanning. In your Adonisjs codebase, look for these patterns:

• Dynamic Xpath construction using template literals or string concatenation with user input
• Use of xmldom, xml2js, xml-query, or similar XML libraries
• Direct interpolation in Xpath expressions: const xpath = `//user[username='${input}']`
• XML database queries without parameterization

middleBrick's automated scanning specifically detects Xpath injection vulnerabilities in Adonisjs applications by:

• Analyzing API endpoints that accept XML input or return XML responses
• Testing for common Xpath injection payloads like ' or ''=', ' and username='' or ''=', and boolean-based payloads
• Checking for authentication bypass through Xpath manipulation
• Scanning for XML external entity (XXE) vulnerabilities that often accompany Xpath injection

The scanning process takes 5-15 seconds and requires no configuration. Simply provide your Adonisjs API endpoint URL:

middlebrick scan https://your-adonisjs-app.com/api/users

middleBrick tests 12 security categories including Xpath injection, returning a security score (A-F) with specific findings and remediation guidance tailored to your Adonisjs application.

Remediating Xpath injection in Adonisjs applications requires proper input validation and safe query construction. Here are Adonisjs-specific approaches:

1. Input Validation with Adonisjs Schema

Use Adonisjs's built-in schema validation to sanitize inputs before they reach Xpath queries:

const { schema } = require('@adonisjs/core/Validator')

const userSchema = schema.create({
  username: schema.string({ escape: true, trim: true }),
  // Additional validation rules
})

2. Parameterized Xpath Queries

While Xpath doesn't have native parameterization like SQL, you can use safe query construction patterns:

const { HttpContextContract } = require('@adonisjs/core/HttpContext')
const { DOMParser } = require('xmldom')

class UserController {
  async findByUsername({ request }) {
    const { username } = await request.validate({
      schema: userSchema
    })
    
    // Safe approach: Use XPath functions instead of direct interpolation
    const xpath = `//user[username='${escapeXPath(username)}']`
    
    const doc = new DOMParser().parseFromString(xmlData)
    const nodes = doc.evaluate(xpath, doc, null, 0, null)
    
    // Process results...
  }
}

function escapeXPath(input) {
  return input.replace(/'/g, ''')
              .replace(/&/g, '&')
              .replace(//g, '>')
              .replace(/"/g, '"')
}

3. Use Adonisjs Middleware for Input Sanitization

Create reusable middleware to sanitize XML-related inputs across your Adonisjs application:

const { schema } = require('@adonisjs/core/Validator')

class XPathSanitizerMiddleware {
  async handle({ request, response }, next) {
    if (request.hasBody()) {
      const body = await request.body()
      
      // Sanitize specific fields that might be used in Xpath queries
      if (body.username) {
        body.username = this.sanitizeForXPath(body.username)
      }
    }
    
    await next()
  }
  
  sanitizeForXPath(input) {
    // Implement your sanitization logic here
    return input.replace(/['"<>]/g, '')
  }
}

module.exports = XPathSanitizerMiddleware

4. Alternative: Avoid Xpath Entirely When Possible

For Adonisjs applications, consider using JSON-based APIs instead of XML processing, or use ORM/database queries instead of XML databases when feasible. Adonisjs's Lucid ORM provides safe, parameterized queries that eliminate Xpath injection risks entirely.