Xpath Injection in Adonisjs with Cockroachdb

XPath Injection becomes relevant in AdonisJS when user-controlled input is concatenated into XPath expressions that are later executed against an XML or HTML document, and the backend uses CockroachDB as the persistence layer. CockroachDB does not directly execute XPath, but it stores the XML-like data (for example, product catalogs, configuration blobs, or user-generated structured content) and supplies it to the application layer. If AdonisJS builds XPath strings using string interpolation or concatenation, an attacker can manipulate the query structure to bypass intended filters, retrieve arbitrary nodes, or infer data existence through timing or error differences.

Consider an endpoint like /users/{id}/preferences where AdonisJS fetches a user record from CockroachDB and then navigates an XML preferences document using an XPath expression built from an unchecked prefPath parameter:

const { request } = useRequest()
const prefsXml = await db.from('users').where('id', request.param('id')).select('preferences_xml').first()
const userPref = prefsXml.preferences_xml.evaluate(`//${request.input('prefPath')}`) // UNSAFE

An attacker supplying prefPath as user/id or 1=1 can alter the logical intent of the XPath, potentially returning nodes that should be hidden. Because the XML data is stored in CockroachDB, the database simply returns the raw document; the vulnerability is introduced when AdonisJS dynamically constructs the XPath without sanitization or use of a safe evaluation API. Additionally, error messages returned by AdonisJS when the XPath is malformed can leak whether nodes exist, aiding enumeration. In this stack, the risk is not in CockroachDB itself but in how AdonisJS composes and evaluates XPath over data retrieved from CockroachDB, especially when combined with unauthenticated LLM endpoint exposure or insecure XML parsing configurations that increase the attack surface.

XPath Injection maps to the OWASP API Top 10 A01:2023-Broken Object Level Authorization and A05:2023-Security Misconfiguration when access controls around XML navigation are weak. A scanner with OpenAPI/Swagger analysis can detect endpoints that accept path-like parameters and flag insecure XPath usage; the same scan that validates LLM/AI Security probes can also test whether crafted inputs cause disproportionate errors or data exposure in XML responses.

Remediation focuses on avoiding dynamic XPath construction and using language-safe APIs. In AdonisJS, prefer parameterized XPath functions or transform the navigation into deterministic logic that does not concatenate user input. Below are concrete, working examples that assume the XML data is stored in a preferences_xml column of a CockroachDB table accessed via AdonisJS Lucid ORM.

Safe approach: use a whitelist and strict validation

Define an allowlist of permitted XPath segments and validate the input against it before any XML processing:

const allowedPaths = new Set(['user/name', 'user/email', 'settings/theme'])
const userInput = request.input('prefPath')
if (!allowedPaths.has(userInput)) {
  throw new Error('Invalid preference path')
}
const prefsXml = await db.from('users').where('id', request.param('id')).select('preferences_xml').first()
// Use a safe DOM parser instead of dynamic evaluate when possible
const document = new DOMParser().parseFromString(prefsXml.preferences_xml)
const node = document.evaluate(`/${userInput}`, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null).singleNodeValue

Alternative: server-side transformation without XPath

If the XML structure is simple, avoid XPath entirely and use JSON conversion or targeted extraction via SQL functions in CockroachDB, reducing reliance on client-side navigation:

// Example: extract a known field using CockroachDB's built-in XML functions
const result = await db.rawQuery(`
  SELECT id, (xpath('/user/name/text()', preferences_xml::xml))[1]::text AS name
  FROM users
  WHERE id = $1
`, [request.param('id')])

General hardening

• Never pass unchecked user input into XPath expressions; use parameterized or compiled XPath objects where the runtime API supports it.
• Configure AdonisJS to return generic error messages for XML parsing failures to avoid information leakage that could aid injection attempts.
• If you must support flexible queries, implement server-side schema validation and strict size limits on XML documents stored in CockroachDB to reduce complexity and parsing risks.

These fixes align with the broader Authentication and Input Validation checks run by middleBrick, which can detect whether your endpoints are vulnerable to XPath Injection and provide prioritized remediation steps. For teams using the Pro plan, continuous monitoring ensures that new endpoints or changes to XML handling do not reintroduce these patterns, while the CLI and GitHub Action integrations can enforce safe XPath practices during development and CI/CD gates.