Xpath Injection in Feathersjs with Basic Auth

Xpath Injection is a server-side injection class where untrusted input is concatenated into an XPath expression, allowing an attacker to alter query logic or access unauthorized data. In Feathersjs applications that use an XML-based data layer or custom transports relying on XPath, unsafe construction of XPath strings can lead to authentication bypass, data exfiltration, or information disclosure.

When Basic Auth is used in Feathersjs, credentials are typically passed via the Authorization header. If the application uses these credentials to build or influence XPath expressions (for example, to select a user node from an XML store), an attacker who can control query parameters or payload fields may inject additional predicates or path segments. A vulnerable pattern looks like:

// Example: building an XPath from user input in a Feathers service hook
const username = context.params.query.user;
const xpath = "/users/user[name='" + username + "' and password='" + password + "']";
// If username = "admin' or '1'='1", the predicate logic is bypassed

In this scenario, even when Basic Auth is enforced, the server-side XPath construction may ignore the authenticated identity and instead rely on unchecked query input. This means an authenticated request can manipulate the XPath to return multiple nodes or an elevated-privilege node. The combination is risky because developers may assume Basic Auth alone is sufficient to isolate user contexts, while unsafe XPath assembly neutralizes that boundary.

An attacker can probe for XPath Injection via fuzzing parameters or body fields that feed into the XPath builder. Findings from a middleBrick scan would highlight insecure string concatenation in hooks or services, and map the issue to the OWASP API Top 10 category of Injection. Because XPath operates on hierarchical data, successful injection can return more data than intended, enabling privilege escalation or data exposure even when transport-level authentication (Basic Auth) is correctly implemented.

Remediation focuses on never building XPath expressions via string concatenation with untrusted input, and ensuring the authenticated identity is derived from the server context rather than from client-controlled query fields.

1. Use parameterized XPath constructs or a safe abstraction layer. For example, if you use a library that supports compiled expressions, prefer it over manual string assembly:

// Safer: use a library that supports parameterized queries or explicit node selection
const { selectUserNode } = require('./xpath-helpers'); // abstracts XPath safely
const userNode = selectUserNode({ userId: context.result.user.id });
// No concatenation; userId is validated and scoped to the authenticated subject

2. Rely on Feathers authentication to scope data. After authentication, the user identity should come from the provider (e.g., the JWT or session), not from request query parameters. With Basic Auth, validate credentials centrally and attach the user identity to the request context:

// Feathers hook that validates Basic Auth and sets user identity
const authBasic = require('feathers-authentication').hooks.authenticate('local');
const setScopedUser = (context) => {
  if (context.params.user) {
    // context.params.user is set by auth hook from validated credentials
    const safeUserId = context.params.user.id;
    // Use safeUserId to scope data access, never concatenate into XPath
    return context;
  }
  throw new Error('Unauthenticated');
};

module.exports = {
  before: {
    all: [authBasic, setScopedUser],
    find: []
  },
  // Service definitions follow
};

3. Enforce strict input validation and allowlisting for any parameters that might influence data selection. Ensure query parameters cannot override the authenticated subject:

// Example: validate and restrict query.user to the authenticated user
const validateQuery = (context) => {
  const authenticatedUserId = context.params.user.id;
  const queryUser = context.params.query.user;
  if (queryUser && queryUser !== authenticatedUserId.toString()) {
    throw new Error('Forbidden: cannot query other users');
  }
  // Proceed with safe, scoped operations
  return context;
};

4. If you must work with raw XPath, use strict escaping and whitelisting, but prefer safer alternatives. Never directly interpolate identifiers or free-text fields:

// Discouraged: only if no abstraction is available and input is strictly controlled
const escapeXpathString = (value) => {
  // Simple escaping for demonstration; prefer library solutions
  return value.replace(/'/g, """);
};
const safeXpath = "/users/user[id='" + escapeXpathString(userId) + "']";
// Still risky; prefer parameterized APIs or server-side scoping

By combining authentication hooks, server-side scoping, and safe data access patterns, Feathersjs services can mitigate Xpath Injection while preserving the use of Basic Auth for transport-level identity verification. middleBrick can detect remaining unsafe string patterns in hooks and services, helping teams identify where XPath construction remains vulnerable.