Xpath Injection in Fastapi with Api Keys

XPath Injection occurs when an attacker can influence an XPath expression constructed from user-controlled input, leading to authentication bypass or data exfiltration. In Fastapi, this typically arises when a service uses XPath to query XML or HTML documents (for example, parsing uploaded Office files, configuration formats, or legacy SOAP payloads) and builds the expression by string concatenation or interpolation with values that may originate from Api Keys or other headers.

When Api Keys are used for authentication in Fastapi, the key value or claims derived from it might be passed into an XPath context. For example, a developer might use the Api Key to select a tenant-specific XML configuration:

from fastapi import Fastapi, Header, HTTPException
import defusedxml.ElementTree as ET

app = Fastapi()

# Example: loading tenant-specific XML by key prefix
def get_tenant_config(api_key: str):
    # Unsafe: api_key used directly in constructing file path or XPath
    path = f"/data/{api_key}/config.xml"
    try:
        tree = ET.parse(path)
        root = tree.getroot()
        # Unsafe XPath: user-influenced key used in selection
        ns = {"t": "http://example.com/ns"}
        # If api_key contains malicious XPath fragments, this is vulnerable
        nodes = root.findall(f".//t:setting[@tenant='{api_key}']", namespaces=ns)
        return [elem.text for elem in nodes]
    except Exception:
        raise HTTPException(status_code=400, detail="Invalid configuration")

@app.get("/settings")
x_api_key: str = Header(...)
def settings(api_key: str = x_api_key):
    return get_tenant_config(api_key)

If the Api Key is attacker-controlled (e.g., via a compromised client or leak), and it flows into XPath without proper sanitization, an attacker can inject expressions such as ' or 1=1 or ' to alter predicate logic, or use path traversal to access unintended nodes. This becomes a critical issue when the XML document contains sensitive configuration or the XPath is used for authorization decisions. Note that this is distinct from SQL injection; here the risk is manipulation of document navigation and selection within an XML tree. Also note that Fastapi does not inherently process XPath; the danger comes from how the application code uses the Api Key in constructing queries against XML/HTML.

In a broader security context, middleBrick’s checks include Input Validation and Property Authorization to detect whether user-influenced data reaches dangerous sinks like XPath selectors. Even though middleBrick does not fix issues, it provides remediation guidance to help developers redesign the flow so that Api Key values are never concatenated into XPath expressions.

Remediation centers on ensuring Api Key values are treated as opaque identifiers and never interpolated into XPath expressions. Prefer parameterized selection or indirect mapping instead of constructing predicates from raw key values.

1) Use a mapping from key to validated identifier

Instead of using the raw Api Key in XPath, validate it against a known set and map it to a safe internal identifier (e.g., tenant ID). This avoids injection by design:

from fastapi import Fastapi, Header, HTTPException
import defusedxml.ElementTree as ET

app = Fastapi()

# Trusted mapping: in practice, load from secure configuration or database
TENANT_BY_KEY = {
    "ak_live_abc123": "tenant_alpha",
    "ak_live_def456": "tenant_beta",
}

def get_tenant_config(tenant_id: str):
    path = f"/data/{tenant_id}/config.xml"
    tree = ET.parse(path)
    root = tree.getroot()
    ns = {"t": "http://example.com/ns"}
    # Safe: tenant_id is validated and controlled, not user-injected
    nodes = root.findall(".//t:setting[@tenant='default']", namespaces=ns)
    return [elem.text for elem in nodes]

@app.get("/settings")
x_api_key: str = Header(...)
def settings(api_key: str = x_api_key):
    tenant_id = TENANT_BY_KEY.get(api_key)
    if tenant_id is None:
        raise HTTPException(status_code=401, detail="Invalid Api Key")
    return get_tenant_config(tenant_id)

2) Avoid XPath construction with user input; use parameterized APIs

Where possible, use ElementTree’s iteration or explicit element access rather than dynamic XPath with user input. If you must search, use predicates based on constants or validated IDs:

import defusedxml.ElementTree as ET

def find_setting_for_tenant(tenant_id: str):
    tree = ET.parse("/data/shared/config.xml")
    root = tree.getroot()
    ns = {"t": "http://example.com/ns"}
    # Iterate safely instead of injecting tenant_id into XPath
    for setting in root.findall(".//t:setting", namespaces=ns):
        if setting.get("tenant") == tenant_id:
            return setting.text
    return None

Additionally, ensure that Api Key handling follows secure patterns: transmit keys only over TLS, avoid logging them, and store them in environment variables or a secrets manager. In Fastapi, you can further reduce risk by using dependencies that validate keys against a backend service and reject malformed or suspicious values before they reach business logic.

middleBrick’s scans can highlight places where Api Key values might reach dangerous sinks. While it does not auto-fix, the findings include prioritized remediation guidance to help you refactor safely and align with OWASP API Security Top 10 and relevant compliance frameworks.