Xpath Injection in Adonisjs with Api Keys

XPath Injection occurs when untrusted data is concatenated into an XPath expression without proper escaping or parameterization, allowing an attacker to alter the logic of the query. In AdonisJS, this typically happens when building dynamic XPath expressions using string concatenation or interpolation to filter or authenticate API requests that rely on API keys.

Consider an AdonisJS service that validates an API key by loading an XML-based configuration or user store and evaluating an XPath expression. If the API key is directly embedded into the XPath string, an attacker can inject malicious predicates. For example, given a user-controlled key stored in key, the following code is vulnerable:

const key = request.input('api_key');
const userNode = xml.evaluate(
  `//user[key='${key}']`,
  xmlDocument,
  null,
  XPathResult.FIRST_ORDERED_NODE_TYPE,
  null
);

An attacker supplying ' or 1=1 or 'a'='a as the key would produce an XPath expression that always evaluates to true, potentially returning the first user node or bypassing intended access controls. Because XPath supports boolean logic, string concatenation, and path traversal, injected segments can change which nodes are selected or cause unintended authentication bypasses.

The risk is amplified when API keys are used to select sensitive data (e.g., tenant identifiers in multi-tenant systems). An attacker who can influence the XPath via a malformed key may retrieve data belonging to other users or escalate privileges if the XPath is also used to grant access. This maps to common weaknesses in input validation and authorization checks, and findings from a scan would highlight both the injection vector and missing data validation.

In a black-box scan, middleBrick tests inputs like API keys in XPath contexts to detect whether crafted payloads can alter query results. It flags cases where string interpolation is used instead of safer alternatives, such as parameterized XPath or strict schema validation, and provides remediation guidance aligned with OWASP API Top 10 and input validation best practices.

To mitigate XPath Injection when using API keys in AdonisJS, avoid building XPath expressions via string concatenation. Instead, use parameterized XPath or strict validation to ensure keys cannot change query structure.

1. Validate and sanitize the API key before use

Treat the API key as an opaque token. Do not attempt to parse or embed it directly in XPath. Validate format (e.g., expected length, character set) and normalize it before comparison.

import { schema } from '@ioc:Adonis/Core/Validator'

const apiKeySchema = schema.create({
  api_key: schema.string({ trim: true, escape: false }, [
    pattern(/^[A-Za-z0-9\-_=]+$/)
  ])
})

export const validateApiKey = async (ctx) => {
  const payload = await schema.validate({ schema: apiKeySchema, data: ctx.request.all() })
  return payload.api_key
}

2. Use parameterized XPath or equality checks instead of string interpolation

Where XPath evaluation is necessary, prefer constructs that treat the key as a value rather than part of the expression. Many JavaScript XPath libraries support variables or positional arguments; if not available, ensure exact equality on a normalized key rather than substring or pattern matching.

const key = validateApiKey(request); // validated, normalized key
// Prefer equality check on a known-safe subset or mapping
const userNode = xml.evaluate(
  '//user',
  xmlDocument,
  null,
  XPathResult.FIRST_ORDERED_NODE_TYPE,
  null
);
let found = null;
for (let i = 0; i < userNode.value.childNodes.length; i++) {
  const candidate = userNode.value.childNodes[i];
  const k = candidate.getElementsByTagName('key')[0]?.textContent;
  if (k === key) {
    found = candidate;
    break;
  }
}
if (!found) {
  throw new Exception('Unauthorized', 401)
}

3. Enforce least-privilege data access

Scope API key usage to the minimal required dataset. If keys map to tenant IDs or user identifiers, resolve them via a trusted data store first, then apply filters in the application layer rather than relying on XPath selection alone.

const key = validateApiKey(request);
const user = await User.findBy('api_key', key)
if (!user) {
  throw new Exception('Unauthorized', 401)
}
// Use ORM/query builder for tenant-safe data access
const resources = await Resource.query().where('user_id', user.id).exec()

By combining strict input validation, safe iteration instead of dynamic XPath construction, and proper authorization checks, you eliminate the injection surface while maintaining the intended access control semantics.