Skip to content

Commit f14b950

Browse files
dschadowdschadow
committed
Added initial XPath Injection sample code
Signed-off-by: Dominik Schadow <[email protected]>
1 parent bfb845b commit f14b950

3 files changed

Lines changed: 125 additions & 0 deletions

File tree

‎Ch06_XPath-Injection/pom.xml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
2+
<modelVersion>4.0.0</modelVersion>
3+
<groupId>de.dominikschadow.webappsecurity</groupId>
4+
<artifactId>xpathinjection</artifactId>
5+
<version>0.0.1-SNAPSHOT</version>
6+
<build>
7+
<sourceDirectory>src</sourceDirectory>
8+
<plugins>
9+
<plugin>
10+
<artifactId>maven-compiler-plugin</artifactId>
11+
<version>2.3.2</version>
12+
<configuration>
13+
<source>1.7</source>
14+
<target>1.7</target>
15+
</configuration>
16+
</plugin>
17+
</plugins>
18+
</build>
19+
</project>

‎Ch06_XPath-Injection/src/main/java/de/dominikschadow/xpathi/XPathInjectionSample.java‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
package de.dominikschadow.xpathi;
2+
3+
import java.io.File;
4+
5+
import javax.xml.parsers.DocumentBuilder;
6+
import javax.xml.parsers.DocumentBuilderFactory;
7+
import javax.xml.xpath.XPathConstants;
8+
import javax.xml.xpath.XPathExpression;
9+
import javax.xml.xpath.XPathExpressionException;
10+
import javax.xml.xpath.XPathFactory;
11+
12+
import org.w3c.dom.Document;
13+
import org.w3c.dom.Element;
14+
import org.w3c.dom.Node;
15+
import org.w3c.dom.NodeList;
16+
17+
public class XPathInjectionSample {
18+
private Document doc;
19+
20+
public static void main(String[] args) {
21+
XPathInjectionSample xis = new XPathInjectionSample();
22+
xis.parseXML();
23+
// valid input
24+
xis.evaluateXPath("/customers/customer[@name='Maier' and @password='MaierPassword']/orderLimit");
25+
// invalid input
26+
xis.evaluateXPath("/customers/customer[@name='dummy' and @password='' or '1' = '1']/orderLimit");
27+
// Blind XPath Injection
28+
xis.evaluateXPath("/customers/customer[@name='dummy' and @password=''] | /* | /foo[bar='']/orderLimit");
29+
}
30+
31+
private void evaluateXPath(String xpath) {
32+
System.out.println("XPath " + xpath);
33+
System.out.println("-----------------------");
34+
35+
try {
36+
XPathExpression expression = XPathFactory.newInstance().newXPath().compile(xpath);
37+
Object result = expression.evaluate(doc, XPathConstants.NODESET);
38+
39+
NodeList nodes = (NodeList) result;
40+
for (int i = 0; i < nodes.getLength(); i++) {
41+
System.out.println(nodes.item(i).getTextContent());
42+
}
43+
} catch (XPathExpressionException ex) {
44+
ex.printStackTrace();
45+
}
46+
}
47+
48+
private void parseXML() {
49+
try {
50+
File xmlFile = new File("src/main/resources/customer.xml");
51+
DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
52+
DocumentBuilder dBuilder = dbFactory.newDocumentBuilder();
53+
doc = dBuilder.parse(xmlFile);
54+
doc.getDocumentElement().normalize();
55+
56+
System.out.println("Root element: " + doc.getDocumentElement().getNodeName());
57+
NodeList customer = doc.getElementsByTagName("customer");
58+
System.out.println("-----------------------");
59+
60+
for (int id = 0; id < customer.getLength(); id++) {
61+
Element element = (Element) customer.item(id);
62+
System.out.println("ID: " + getAttributeValue("id", element));
63+
System.out.println("name: " + getAttributeValue("name", element));
64+
System.out.println("status: " + getTagValue("status", element));
65+
System.out.println("order limit: " + getTagValue("orderLimit", element));
66+
}
67+
} catch (Exception ex) {
68+
ex.printStackTrace();
69+
}
70+
}
71+
72+
private String getTagValue(String tag, Element element) {
73+
Node elementNode = element.getElementsByTagName(tag).item(0).getChildNodes().item(0);
74+
75+
return elementNode.getNodeValue();
76+
}
77+
78+
private String getAttributeValue(String attribute, Element element) {
79+
Node attributeNode = element.getAttributes().getNamedItem(attribute);
80+
81+
return attributeNode.getNodeValue();
82+
}
83+
}

‎Ch06_XPath-Injection/src/main/resources/customer.xml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<customers>
3+
<customer id="1" name="Müller" password="MuellerPassword">
4+
<status>A</status>
5+
<orderLimit>10000</orderLimit>
6+
</customer>
7+
<customer id="2" name="Kaiser" password="KaiserPassword">
8+
<status>B</status>
9+
<orderLimit>5000</orderLimit>
10+
</customer>
11+
<customer id="3" name="Hammel" password="HammelPassword">
12+
<status>C</status>
13+
<orderLimit>500</orderLimit>
14+
</customer>
15+
<customer id="4" name="Gretchen" password="GretchenPassword">
16+
<status>D</status>
17+
<orderLimit>50</orderLimit>
18+
</customer>
19+
<customer id="5" name="Maier" password="MaierPassword">
20+
<status>C</status>
21+
<orderLimit>100</orderLimit>
22+
</customer>
23+
</customers>

0 commit comments

Comments
 (0)