Merge branch 'hotfix/NODE-121-xpath-injection'

Author: bizob2828

lib/content/index.js

@@ -1,4 +1,5 @@
 module.exports = {
   nosqlInjection: require('./nosqlInjection'),
+  xpathInjection: require('./xpathInjection'),
   xxe: require('./xxe')
 };

lib/content/xpathInjection.js

@@ -0,0 +1,17 @@
+module.exports.xml = `
+<?xml version="1.0"?>
+<users>
+  <user>
+    <username>admin</username>
+    <password>admin</password>
+  </user>
+  <user>
+    <username>user1</username>
+    <password>123456</password>
+  </user>
+  <user>
+    <username>tony</username>
+    <password>ynot</password>
+  </user>
+</users>
+`;

lib/routes.js

@@ -96,5 +96,13 @@ module.exports = {
     products: ['Protect'],
     inputs: ['query'],
     sinks: sinks.untrustedDeserialization
+  },
+  xpathInjection: {
+    base: '/xpathInjection',
+    name: 'XPath Injection',
+    link: 'https://owasp.org/www-community/attacks/XPATH_Injection',
+    products: ['Assess'],
+    inputs: ['query'],
+    sinks: sinks.xpathInjection
   }
 };

lib/sinks/index.js

@@ -11,5 +11,6 @@ module.exports = {
   unvalidatedRedirect: require('./unvalidatedRedirect'),
   xss: require('./xss'),
   xxe: require('./xxe'),
-  untrustedDeserialization: require('./untrustedDeserialization')
+  untrustedDeserialization: require('./untrustedDeserialization'),
+  xpathInjection: require('./xpathInjection')
 };

lib/sinks/xpathInjection.js

@@ -0,0 +1,20 @@
+'use strict';
+const xpath = require('xpath');
+const { DOMParser } = require('xmldom');
+const { xml } = require('../content/xpathInjection');
+const doc = new DOMParser().parseFromString(xml);
+
+module.exports['xpath.select'] = async function select(
+  input,
+  { safe = false, noop = false } = {}
+) {
+  if (noop) return 'NOOP';
+
+  const path = safe ? encodeURIComponent(input) : input;
+
+  return new Promise((resolve) => {
+    const searchString = `//user[username/text()='${path}']`;
+    const user = xpath.select(searchString, doc).toString();
+    resolve(user);
+  });
+};

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/test-bench-utils",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "description": "Shared code to use in Contrast's web framework test apps.",
   "main": "lib/index.js",
   "scripts": {
@@ -36,7 +36,9 @@
     "request": "^2.88.0",
     "sequelize": "^5.21.1",
     "sql-template-strings": "^2.2.2",
-    "superagent": "^5.0.5"
+    "superagent": "^5.0.5",
+    "xmldom": "^0.2.1",
+    "xpath": "0.0.27"
   },
   "devDependencies": {
     "@contrast/eslint-config": "^1.0.3",