Xpath Injection in Feathersjs with Firestore

FeathersJS is a JavaScript framework for building REST and real-time APIs. When a FeathersJS service uses Firestore as a data store, it typically interacts with Firestore via the Firebase Admin SDK or a client SDK. If user input is used to construct Firestore queries or is passed into any dynamic evaluation path, an Xpath Injection risk can emerge when the application also processes XML or JSON that is later evaluated with XPath-like expressions (for example, via a custom XML parser or an XPath helper library).

Xpath Injection occurs when untrusted data is concatenated into an XPath expression without proper sanitization or parameterization. In a FeathersJS + Firestore setup, this can happen if you retrieve an XML document from Firestore (or an external service), then build an XPath query by string concatenation using user-supplied values such as req.query.id or req.body. For example:

const userInput = req.query.filter; // untrusted
const xpath = '//record[id=' + userInput + ']';
const nodes = xmldoc.evaluate(xpath, xmlDocument, null, XPathResult.ANY_TYPE, null);

If userInput contains something like ' or 1=1 or ', the resulting XPath can return unintended nodes, leading to data exposure or bypassed authorization checks. Even though Firestore itself does not use XPath, the vulnerability arises when Firestore data is exported or used in contexts where XML parsing and XPath evaluation occur. The 12 parallel security checks in middleBrick test these injection surfaces by probing inputs that reach query construction and XML handling paths, identifying whether untrusted data can manipulate selection logic.

Additionally, an unauthenticated endpoint in FeathersJS that exposes Firestore data via XML serialization can become an LLM/AI Security vector if model outputs or system prompts are embedded in XML and later parsed with XPath. middleBrick’s LLM/AI Security checks include system prompt leakage detection and active prompt injection testing to identify whether XPath handling paths can be abused to extract internal instructions or sensitive data from model-generated XML responses.

Remediation focuses on ensuring that user input never directly concatenates into query or XPath expressions. For Firestore queries in FeathersJS, use parameterized queries and avoid dynamic string assembly. For XML processing, prefer DOM-based navigation or safe XPath APIs that support parameter binding.

Firestore query remediation: Use Firestore’s built-in filtering and avoid building queries via string concatenation. Instead of:

const userInput = req.query.status;
const ref = admin.firestore().collection('items');
let query = ref.where('status', '==', userInput); // safe when using SDK methods
// Avoid: ref.where('status', '==', userInput) is already safe; do not build strings

If you must build dynamic queries, validate and sanitize inputs strictly and use Firestore’s supported operators rather than constructing raw strings.

XPath remediation: When you must evaluate XPath on XML retrieved from Firestore, use a secure parser that supports parameterized expressions. For example, with an XPath evaluator that supports namespaces and context items:

const userInput = req.query.filter;
const xpath = '//record[id= $id]'; // parameterized expression
const result = xmldoc.evaluate(xpath, xmlDocument, null, XPathResult.ANY_TYPE, null, { id: userInput });

If your environment does not support parameterized XPath, sanitize userInput by allowing only expected patterns (e.g., alphanumeric IDs) and rejecting any characters used for injection such as quotes or operators. Additionally, ensure that any XML serialization of Firestore documents does not embed untrusted data into element names or attribute values that could be used to manipulate XPath navigation.

For continuous assurance, the middleBrick Pro plan includes continuous monitoring and configurable scanning schedules so that new endpoints or changes to XML handling logic are automatically tested. You can integrate middleBrick into CI/CD with the GitHub Action to fail builds if security findings appear, and use the CLI to scan endpoints from the terminal with middlebrick scan <url>. The MCP Server also enables scanning APIs directly from AI coding assistants while you develop, helping catch risky concatenation patterns early.