XQuery Injection

Constructing a dynamic XQuery expression with user input could allow an attacker to modify the statement's meaning.

XQuery injection occurs when:

1. Data enters a program from an untrusted source.



2. The data used to dynamically construct an XQuery expression.

Example 1: The following code dynamically constructs and executes an XQuery expression that retrieves a user account for a given username and password combination. The username and password are read from an HTTP request, and are therefore untrusted.

  ...

  String squery = "for \$user in doc(users.xml)//user[username='" + Request["username"] + "'and pass='" + Request["password"] + "'] return \$user";

  Processor processor = new Processor();

  XdmNode indoc = processor.NewDocumentBuilder().Build(new Uri(Server.MapPath("users.xml")));

  StreamReader query = new StreamReader(squery);
  XQueryCompiler compiler = processor.NewXQueryCompiler();
  XQueryExecutable exp = compiler.Compile(query.ReadToEnd());
  XQueryEvaluator eval = exp.Load();
  eval.ContextItem = indoc;

  Serializer qout = new Serializer();
  qout.SetOutputProperty(Serializer.METHOD, "xml");
  qout.SetOutputProperty(Serializer.DOCTYPE_PUBLIC, "-//W3C//DTD XHTML 1.0 Strict//EN");
  qout.SetOutputProperty(Serializer.DOCTYPE_SYSTEM, "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd");
  qout.SetOutputProperty(Serializer.INDENT, "yes");
  qout.SetOutputProperty(Serializer.OMIT_XML_DECLARATION, "no");

  qout.SetOutputWriter(Response.Output);
  eval.Run(qout);

  ...
  

Under normal conditions, such as searching for a user account with the appropriate username and password, the expression that this code executes will look like the following:

for \$user in doc(users.xml)//user[username='test_user' and pass='pass123'] return \$user

However, because the expression is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if username or password does not contain a single-quote character. If an attacker enters the string admin' or 1=1 or ''=' for username, then the query becomes the following:

for \$user in doc(users.xml)//user[username='admin' or 1=1 or ''='' and password='x' or ''=''] return \$user

The addition of the admin' or 1=1 or ''=' condition causes the XQuery expression to always evaluate to true, so the query becomes logically equivalent to the much simpler query:

//user[username='admin']

This simplification of the query allows the attacker to bypass the requirement that the query match the password; the query now returns the admin user stored in the document, regardless of the entered password.

Constructing a dynamic XQuery expression with user input could allow an attacker to modify the statement's meaning.

XQuery injection occurs when:

1. Data enters a program from an untrusted source.



2. The data is used to dynamically construct an XQuery expression.

Example 1: The following code dynamically constructs and executes an XQuery expression that retrieves a user account for a given username and password combination. The username and password are read from an HTTP request, and are therefore untrusted.

...

$memstor = InMemoryStore::getInstance();
$z = Zorba::getInstance($memstor);

try {
  // get data manager
  $dataman = $z->getXmlDataManager();

  // load external XML document
  $dataman->loadDocument('users.xml', file_get_contents('users.xml'));

  // create and compile query
  $express =
"for \$user in doc(users.xml)//user[username='" . $_GET["username"] . "'and pass='" . $_GET["password"] . "'] return \$user"

  $query = $zorba->compileQuery($express);

  // execute query
  $result = $query->execute();



?>
...

Under normal conditions, such as searching for a user account with the appropriate username and password, the expression that this code executes will look like the following:

for \$user in doc(users.xml)//user[username='test_user' and pass='pass123'] return \$user

However, because the expression is constructed dynamically by concatenating a constant query string and a user input string, the query only behaves correctly if username or password does not contain a single-quote character. If an attacker enters the string admin' or 1=1 or ''=' for username, then the query becomes the following:

for \$user in doc(users.xml)//user[username='admin' or 1=1 or ''='' and password='x' or ''=''] return \$user

The addition of the admin' or 1=1 or ''=' condition causes the XQuery expression to always evaluate to true, so the query becomes logically equivalent to the much simpler query:

//user[username='admin']

This simplification of the query allows the attacker to bypass the requirement that the query match the password; the query now returns the admin user stored in the document, regardless of the entered password.