From: Ken Bloom <kbloom@...>
Date: 2008-04-29T23:15:13+09:00
Subject: Documentation Patch: Preventing XPath Injection attacks

Here's a patch to rexml/xpath.rb which documents the variables parameter 
in REXML::XPath.


--- xpath.rb.old	2008-04-24 17:31:51.000000000 -0500
+++ xpath.rb	2008-04-24 17:37:38.000000000 -0500
@@ -15,10 +15,15 @@
 		# 	node matching '*'.
 		# namespaces::
 		# 	If supplied, a Hash which defines a namespace mapping.
+		# variables::
+		#       If supplied, a Hash which maps $variables in the query
+		#       to values. This can be used to avoid XPath injection attacks
+		#       or to automatically handle escaping string values.
 		#
 		#  XPath.first( node )
 		#  XPath.first( doc, "//b"} )
 		#  XPath.first( node, "a/x:b", { "x"=>"http://doofus" } )
+		#  XPath.first( node, '/book/publisher/text()=$publisher', {}, {"publisher"=>"O'Reilly"})
     def XPath::first element, path=nil, namespaces=nil, variables={}
       raise "The namespaces argument, if supplied, must be a hash object." unless namespaces.nil? or namespaces.kind_of?(Hash)
       raise "The variables argument, if supplied, must be a hash object." unless variables.kind_of?(Hash)
@@ -38,10 +43,16 @@
 		#   The xpath to search for.  If not supplied or nil, defaults to '*'
 		# namespaces::
 		# 	If supplied, a Hash which defines a namespace mapping
+		# variables::
+		#       If supplied, a Hash which maps $variables in the query
+		#       to values. This can be used to avoid XPath injection attacks
+		#       or to automatically handle escaping string values.
 		#
 		#  XPath.each( node ) { |el| ... }
 		#  XPath.each( node, '/*[@attr='v']' ) { |el| ... }
 		#  XPath.each( node, 'ancestor::x' ) { |el| ... }
+		#  XPath.each( node, '/book/publisher/text()=$publisher', {}, {"publisher"=>"O'Reilly"}) \
+		#    {|el| ... }
 		def XPath::each element, path=nil, namespaces=nil, variables={}, &block
       raise "The namespaces argument, if supplied, must be a hash object." unless namespaces.nil? or namespaces.kind_of?(Hash)
       raise "The variables argument, if supplied, must be a hash object." unless variables.kind_of?(Hash)


-- 
Ken (Chanoch) Bloom. PhD candidate. Linguistic Cognition Laboratory.
Department of Computer Science. Illinois Institute of Technology.
http://www.iit.edu/~kbloom1/