CVE

There is no CVE for this.

Report

This query adds Xpath injection query to codeql-python. It models the lxml package.

It detects the following code patterns.

f = StringIO('<foo><bar></bar></foo>')
tree = etree.parse(f)
r = tree.xpath('`sink`')

root = etree.XML("<xmlContent>")
find_text = etree.XPath("`sink`")

root = etree.XML("<xmlContent>")
find_text = etree.EtXPath("`sink`")

The PR also includes necessary tests for the same.

Link to the corresponding PR [github/codeql#3522]