XPATH Injection Java - Revision history

Imifos: Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2017-11-10T21:50:32Z

Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2016-08-14T09:42:07Z

Fix error in SimpleVariableResolver class (use static field and it was on mistake)

2014-02-23T09:05:53Z

Update list of categories

2014-02-23T09:04:01Z

Add counter measure using variable resolver

2013-07-14T09:15:03Z

fix date error

2013-07-14T09:14:36Z

2013-07-14T09:13:59Z

update date

2013-07-14T09:13:31Z

Add tips about use of variable into XPATH expression

2012-06-03T09:51:24Z

Fix EN styles

2012-06-03T09:49:19Z

Fix orthograph mistakes

@@ Line 270: / Line 270: @@
 </pre>
-[[Category:OWASP Java Project]]
+[[Category:Java]]
 [[Category:Injection Attack]]

@@ Line 1: / Line 1: @@
-Last revision (mm/dd/yy): '''02/23/2014'''
+Last revision (mm/dd/yy): '''08/14/2016'''
@@ Line 196: / Line 196: @@
 public class SimpleVariableResolver implements XPathVariableResolver {
-	private static final Map<QName, Object> vars = new HashMap<QName, Object>();
+	private final Map<QName, Object> vars = new HashMap<QName, Object>();
 	/**

@@ Line 1: / Line 1: @@
-Last revision (mm/dd/yy): '''07/14/2013'''
+Last revision (mm/dd/yy): '''02/23/2014'''
@@ Line 118: / Line 118: @@
 [[File:XPATHInjection02.png]]
-== Injection countermeasure ==
+== Injection countermeasure n°1 ==
 Input used into an XPATH expression must not contains any of the characters below:
 <pre>( ) = ' [ ] : , * / WHITESPACE</pre>
@@ Line 175: / Line 175: @@
 </pre>
-== Remarks ==
+== Injection countermeasure n°2 ==
 Using variable into XPATH expression with a variable resolver enabled evaluator can help to prevent injections (like prepared statement for SQL injection).
 [[Category:OWASP Java Project]]

@@ Line 176: / Line 176: @@
 == Remarks ==
-Using variable into XPATH expression with a variable resolver enabled evaluator can help to prevent injections like prepared statement for SQL.
+Using variable into XPATH expression with a variable resolver enabled evaluator can help to prevent injections (like prepared statement for SQL injection).
 == Note ==

@@ Line 174: / Line 174: @@
+}
 </pre>
 == Note ==
-See into your web framework if validation content methods exists or use OWASP dedicated API ;o)
+See into your web framework if validation content methods exists or use OWASP dedicated API.
 [[Category:OWASP Java Project]]

← Older revision		Revision as of 09:51, 3 June 2012
Line 122:		Line 122:
	<pre>( ) = ' [ ] : , * / WHITESPACE</pre>		<pre>( ) = ' [ ] : , * / WHITESPACE</pre>

−	According to our example context, the modification to apply ~~can~~ be to create an application transversal utility method ~~that check~~ the presence of characters above and ~~reject~~ the value submitted if it's contains any one.	+	According to our example context, the modification to apply could be to create an application transversal utility method checking the presence of characters above and rejecting the value submitted if it's contains any one.

@@ Line 107: / Line 107: @@
 <pre>'%20or%20'1'='1</pre>
 '''Result''':
-All employees nodes are selected (in this cases the user do not known the XML structure).
+All employees nodes are selected (in this case the user do not known the XML structure).
 [[File:XPATHInjection01.png]]
@@ Line 114: / Line 114: @@
 <pre>'%20or%20fn:contains(fn:lower-case(@lastname),'dobora')%20or%20'</pre>
 '''Result''':
-Employee where the last name contains "dobora" is selected (in this cases the user has guessed the XML structure).
+Employee where the last name contains "dobora" is selected (in this case the user has guessed the XML structure).
 [[File:XPATHInjection02.png]]