Xpath Injection in Fastapi with Cockroachdb

XPath Injection occurs when user input is concatenated into an XPath expression without proper sanitization or parameterization. In a Fastapi application using Cockroachdb, this typically manifests through endpoints that build XPath queries dynamically—often when integrating with XML stores or document databases that expose XML data via SQL interfaces. Cockroachdb supports SQL and PostgreSQL-compatible interfaces; while it does not natively store XML as a native type, applications may store XML text in TEXT or STRING columns and parse it in application code or via extensions that support XPath evaluation. If Fastapi routes construct XPath expressions by string interpolation using request-controlled values (e.g., query parameters or JSON fields), attackers can inject additional path segments or predicates to alter traversal logic.

The risk is amplified when authentication is not enforced for the endpoint (unauthenticated attack surface), as middleBrick’s unauthenticated scan would flag the Xpath Injection check alongside BOLA/IDOR and Input Validation findings. A typical vulnerable pattern in Fastapi might involve concatenating a user-supplied identifier into an XPath selection used to query XML fragments retrieved from Cockroachdb. For example, an endpoint like /users/{user_id}/preferences could build an XPath such as //user[id='{user_id}'] by directly interpolating the path parameter, enabling an attacker to escape the intended context with ' or '1'='1 or path-based traversal like ../../admin. Even when Cockroachdb stores data securely, the vulnerability lives in the application layer where XPath expressions are composed, and middleBrick’s parallel security checks would highlight this alongside Property Authorization and Input Validation failures.

Because middleBrick scans the unauthenticated attack surface in 5–15 seconds, it can detect whether XPath Injection is present by probing endpoints that accept input used in path-like selectors. Findings include severity-ranked guidance emphasizing input validation and strict separation of data from control logic. The scanner also cross-references OpenAPI specs to see whether parameters are declared as path or query variables, ensuring the injection surface is accurately mapped.

To remediate Xpath Injection in Fastapi with Cockroachdb, avoid building XPath expressions via string concatenation. Instead, use parameterized approaches wherever possible and treat XML data as opaque strings when querying. Below are concrete code examples demonstrating secure patterns.

Example 1: Safe retrieval without XPath injection
Use Cockroachdb’s SQL interface to fetch XML/text data by primary key, then process it safely in Python without dynamic XPath construction based on user input.

from fastapi import FastAPI, HTTPException
import psycopg2
from psycopg2 import sql

app = FastAPI()

def get_db_connection():
    return psycopg2.connect(
        host="your-cockroachdb-host",
        port="26257",
        user="your_user",
        password="your_password",
        database="your_db"
    )

@app.get("/users/{user_id}/profile")
def get_user_profile(user_id: int):
    query = sql.SQL("SELECT data_xml FROM users WHERE id = %s")
    with get_db_connection() as conn:
        with conn.cursor() as cur:
            cur.execute(query, (user_id,))
            row = cur.fetchone()
    if row is None:
        raise HTTPException(status_code=404, detail="User not found")
    xml_data = row[0]
    # Process xml_data safely; do not build XPath from user input
    return {"xml": xml_data}

Example 2: Avoiding XPath construction entirely
If your workflow requires querying structured XML fragments stored as text, parse them with a safe library and filter in Python rather than constructing XPath expressions with user input.

from lxml import etree
from fastapi import FastAPI
import psycopg2

app = FastAPI()

@app.get("/users/{user_id}/setting")
def get_user_setting(user_id: int, setting_key: str):
    conn = psycopg2.connect(
        host="your-cockroachdb-host",
        port="26257",
        user="your_user",
        password="your_password",
        database="your_db"
    )
    cur = conn.cursor()
    cur.execute("SELECT data_xml FROM users WHERE id = %s", (user_id,))
    row = cur.fetchone()
    conn.close()
    if not row:
        raise HTTPException(status_code=404, detail="User not found")
    xml_text = row[0]
    root = etree.fromstring(xml_text)
    # Safe: filter in Python, not via XPath built from user input
    for elem in root.xpath(".//setting"):
        if elem.get("key") == setting_key:
            return {"value": elem.text}
    raise HTTPException(status_code=404, detail="Setting not found")

These examples emphasize using parameterized SQL for data retrieval and avoiding dynamic XPath assembly from untrusted sources. middleBrick’s scans will verify that endpoints do not concatenate user input into XPath-like selectors and will surface the issue under BOLA/IDOR, Input Validation, and LLM/AI Security if applicable. For continuous coverage, use the Pro plan to enable continuous monitoring and integrate the GitHub Action to fail builds if risk thresholds are exceeded.