Xpath Injection in Adonisjs with Basic Auth

Xpath Injection occurs when an attacker can influence an XPath expression constructed from user-controlled input, enabling authentication bypass or data exfiltration. In AdonisJS, this risk is amplified when Basic Auth is used for initial access control and then application logic builds XPath queries using unchecked user data.

Consider a scenario where Basic Auth identifies the user identity (e.g., username), and the application uses additional parameters such as username or record ID to construct an XPath query without sanitization. For example:

// routes.js (conceptual route handler pseudocode)
router.get('/users/:username', async (ctx) => {
  const { username } = ctx.params;
  // Unsafe concatenation: username from URL is directly embedded into XPath
  const xpath = `/users/user[name='${username}']`;
  const result = await User.queryByXPath(xpath);
  ctx.response.json(result);
});

An authenticated user authenticated via HTTP Basic Auth as alice could manipulate the URL parameter username to values such as ' or '1'='1, altering the logical structure of the XPath to return all user nodes. Because Basic Auth provides an identity token, the application may incorrectly assume that subsequent input tied to that identity is trustworthy, leading to an authorization issue where one user can access another’s data via manipulated XPath results.

Another common pattern involves using XPath for configuration or metadata lookup, where the attacker’s injected expression returns sensitive nodes (e.g., admin flags). In AdonisJS, if the XPath is built dynamically using user-supplied input combined with a Basic Auth–derived identity, the resulting query may bypass intended scoping, effectively turning an authenticated endpoint into an Insecure Direct Object Reference (IDOR) or data exposure vector.

Moreover, XPath functions and axes can be abused to enumerate unintended data when input is not properly escaped or validated. For instance, functions like contains() or starts-with() can be leveraged to iteratively extract information through boolean-based blind techniques if the application exposes differences in response behavior or timing.

Remediation centers on strict input validation, avoiding string concatenation for XPath, and treating Basic Auth identity as a separate, verified claim rather than implicit trust for downstream queries.

1. Use parameterized XPath or safe query builders

Instead of interpolating user input into XPath strings, use libraries or APIs that support parameterized queries or path segment validation. For example, avoid constructing XPath via string concatenation; prefer whitelisted identifiers or ORM-based access:

// Safe approach: resolve user via authenticated identity and ORM, not XPath
router.get('/users/:username', async (ctx) => {
  const { username } = ctx.params;
  // Validate format strictly (alphanumeric + limited special chars)
  if (!/^[a-zA-Z0-9_.-]+$/.test(username)) {
    ctx.status = 400;
    ctx.body = { error: 'Invalid username format' };
    return;
  }
  // Use AdonisJS model query instead of raw XPath
  const user = await User.findByOrFail('username', username);
  // Ensure the authenticated identity matches the requested resource
  const authUser = ctx.auth.getUser();
  if (authUser && authUser.username !== username) {
    ctx.status = 403;
    ctx.body = { error: 'Forbidden: cannot access other user data' };
    return;
  }
  ctx.response.json(user);
});

2. If XPath is required, escape and normalize inputs rigorously

When XPath is unavoidable, escape quotes and normalize input to prevent expression breaking. For example, replace single quotes with their escaped equivalents and enforce strict character sets:

// Minimal safety when XPath is necessary
function escapeXpathString(value) {
  // Replace single quote with two single quotes per XPath 1.0 string rules
  return value.replace(/'/g, "''");
}
router.get('/users/:username', async (ctx) => {
  const rawUsername = ctx.params.username;
  if (!/^[a-zA-Z0-9_.-]+$/.test(rawUsername)) {
    ctx.status = 400;
    ctx.body = { error: 'Invalid username format' };
    return;
  }
  const safeUsername = escapeXpathString(rawUsername);
  const xpath = `/users/user[name='${safeUsername}']`;
  const result = await User.queryByXPath(xpath);
  // Additional scoping check: ensure result aligns with auth context
  const authUser = ctx.auth.getUser();
  if (authUser && result && result.username !== authUser.username) {
    ctx.status = 403;
    ctx.body = { error: 'Forbidden' };
    return;
  }
  ctx.response.json(result);
});

3. Enforce strict Basic Auth scoping and avoid implicit trust

Treat the username claimed by Basic Auth as the source of identity, and do not allow URL or body parameters to override the subject of the query without additional authorization checks. Combine route parameters with verified claims:

// Example: using ctx.auth.getUser() to enforce ownership
router.put('/users/:username/profile', async (ctx) => {
  const user = await User.findBy('username', ctx.params.username);
  const authUser = ctx.auth.getUser();
  if (!user || !authUser || user.id !== authUser.id) {
    ctx.status = 403;
    ctx.body = { error: 'Unauthorized' };
    return;
  }
  // Proceed with safe update logic
  user.profile = ctx.request.body.profile;
  await user.save();
  ctx.response.json(user);
});

These practices reduce the attack surface by eliminating direct XPath concatenation, validating and escaping inputs, and ensuring that Basic Auth identity is used for authorization rather than as a proxy for input trust.