securitylab: Java: CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

CVE

There is no CVE for this.

Report

This query add XQuery Injection sinks.

String name = request.getParameter("name");
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
String query = "for $user in doc(\"users.xml\")/Users/User[name='" + name + "'] return $user/password";
XQPreparedExpression xqpe = conn.prepareExpression(query);
XQResultSequence result = xqpe.executeQuery();

Added CWE-652.

please check:

codeql/java/ql/src/Security/CWE/CWE-652/*

Result(s)

• Link to the PR: https://github.com/github/codeql/pull/4994