Xpath Injection in Fiber with Dynamodb

XPath Injection becomes relevant in a Fiber application when user-controlled input is used to construct XPath expressions that query data, and that data is sourced from a DynamoDB table. While DynamoDB itself does not use XPath, an application may retrieve items from DynamoDB and then process or filter them in-memory using XPath over an XML representation or via an intermediate layer that exposes XPath-like navigation. If the XPath expression is built by concatenating user input without sanitization or parameterized construction, an attacker can manipulate the expression to access unintended nodes, bypass filters, or extract sensitive data.

In a typical scenario, a Fiber route might fetch an item from DynamoDB using a direct key lookup (e.g., a user ID), then transform the item into an XML structure for legacy system integration. The application might then apply an XPath expression provided via a query parameter to select specific fields. Because the DynamoDB lookup is authenticated and the XPath is constructed dynamically, the attacker does not need valid credentials to exploit the injection; they simply supply crafted query input such as ' or 1=1 or ' as part of the XPath string. This can lead to data exposure of other users' records, bypass intended access controls, or reveal internal data structures that should remain private.

The risk is compounded when the XPath is built using string interpolation in JavaScript/TypeScript within the Fiber handler. For example, reading an XML document derived from a DynamoDB item and applying an XPath like /user[username='$username']/email with unsanitized input enables injection. Although DynamoDB access is properly authenticated, the unchecked XPath construction shifts the vulnerability to the application layer, where the data retrieved from DynamoDB is processed. This shows how a securely accessed data store can still lead to insecure processing logic.

middleBrick detects such issues under its Input Validation and Property Authorization checks by analyzing the unauthenticated attack surface and, where relevant, correlating runtime behavior with OpenAPI/Swagger specs (including $ref resolution) to highlight insecure construction patterns. For LLM-related endpoints, the LLM/AI Security checks also flag exposed endpoints that could be abused for prompt injection or data exfiltration when XPath-like navigation is involved in downstream processing.

To prevent XPath Injection when integrating Fiber with DynamoDB, avoid constructing XPath expressions using raw user input. Instead, use parameterized XPath evaluation where possible, or better yet, filter data programmatically after retrieving items from DynamoDB. If you must use XPath, validate and sanitize input against a strict allowlist and avoid injecting user input directly into expression strings.

Below are concrete code examples for a Fiber route that retrieves an item from DynamoDB and processes it safely.

Unsafe Example (Vulnerable)

const express = require('express');
const { DynamoDBClient, GetItemCommand } = require('@aws-sdk/client-dynamodb');
const { parseStringPromise } = require('xml2js');
const app = express();

app.get('/user-email', async (req, res) => {
  const userId = req.query.id;
  const client = new DynamoDBClient({ region: 'us-east-1' });
  const cmd = new GetItemCommand({
    TableName: 'Users',
    Key: { userId: { S: userId } }
  });
  const { Item } = await client.send(cmd);
  const xml = convertToXml(Item); // hypothetical conversion
  const selector = `/user[username='${req.query.username}']/email`; // UNSAFE
  const result = await evaluateXPath(xml, selector);
  res.send(result);
});

Secure Example (Remediated)

const { parseStringPromise } = require('xml2js');

app.get('/user-email', async (req, res) => {
  const userId = req.query.id;
  const username = req.query.username;
  const client = new DynamoDBClient({ region: 'us-east-1' });
  const cmd = new GetItemCommand({
    TableName: 'Users',
    Key: { userId: { S: userId } }
  });
  const { Item } = await client.send(cmd);
  const xml = convertToXml(Item);

  // Validate username against an allowlist pattern (e.g., alphanumeric, length)
  if (!/^[a-zA-Z0-9_]{3,30}$/.test(username)) {
    return res.status(400).send({ error: 'Invalid username format' });
  }

  // Use a proper XPath library that supports parameterized variables
  const xpath = require('xpath');
  const document = xpath.parseXml(xml);
  const expr = xpath.compile('/user[username=$username]/email');
  const result = expr.evaluate(document, {
    username: username
  });

  res.send(result);
});

In the secure version, user input is validated with a strict allowlist before use. The XPath expression uses a parameterized variable ($username) supported by libraries like xpath in Node.js, which ensures the input is treated as data, not executable expression logic. This approach keeps DynamoDB access patterns intact while eliminating injection risk in XPath processing.

Additionally, consider filtering fields programmatically after retrieving the DynamoDB item instead of using XPath at all. For example, extract only the required fields in JavaScript, which avoids XML/XPath complexity and reduces attack surface. middleBrick’s CLI tool can help verify that your endpoints do not exhibit injection-prone patterns by scanning the unauthenticated surface and highlighting validation gaps.