From: Roger Pack <rogerpack2005@...>
Date: 2008-04-30T02:11:10+09:00
Subject: Re: Documentation Patch: Preventing XPath Injection attacks

may want to send that to ruby-core :)
-R

On Tue, Apr 29, 2008 at 8:15 AM, Ken Bloom <kbloom@gmail.com> wrote:
> Here's a patch to rexml/xpath.rb which documents the variables parameter
>  in REXML::XPath.
>
>
>  --- xpath.rb.old        2008-04-24 17:31:51.000000000 -0500
>  +++ xpath.rb    2008-04-24 17:37:38.000000000 -0500
>  @@ -15,10 +15,15 @@
>                 #       node matching '*'.
>                 # namespaces::
>                 #       If supplied, a Hash which defines a namespace mapping.
>  +               # variables::
>  +               #       If supplied, a Hash which maps $variables in the query
>  +               #       to values. This can be used to avoid XPath injection attacks
>  +               #       or to automatically handle escaping string values.
>                 #
>                 #  XPath.first( node )
>                 #  XPath.first( doc, "//b"} )
>                 #  XPath.first( node, "a/x:b", { "x"=>"http://doofus" } )
>  +               #  XPath.first( node, '/book/publisher/text()=$publisher', {}, {"publisher"=>"O'Reilly"})
>      def XPath::first element, path=nil, namespaces=nil, variables={}
>        raise "The namespaces argument, if supplied, must be a hash object." unless namespaces.nil? or namespaces.kind_of?(Hash)
>        raise "The variables argument, if supplied, must be a hash object." unless variables.kind_of?(Hash)
>  @@ -38,10 +43,16 @@
>                 #   The xpath to search for.  If not supplied or nil, defaults to '*'
>                 # namespaces::
>                 #       If supplied, a Hash which defines a namespace mapping
>  +               # variables::
>  +               #       If supplied, a Hash which maps $variables in the query
>  +               #       to values. This can be used to avoid XPath injection attacks
>  +               #       or to automatically handle escaping string values.
>                 #
>                 #  XPath.each( node ) { |el| ... }
>                 #  XPath.each( node, '/*[@attr='v']' ) { |el| ... }
>                 #  XPath.each( node, 'ancestor::x' ) { |el| ... }
>  +               #  XPath.each( node, '/book/publisher/text()=$publisher', {}, {"publisher"=>"O'Reilly"}) \
>  +               #    {|el| ... }
>                 def XPath::each element, path=nil, namespaces=nil, variables={}, &block
>        raise "The namespaces argument, if supplied, must be a hash object." unless namespaces.nil? or namespaces.kind_of?(Hash)
>        raise "The variables argument, if supplied, must be a hash object." unless variables.kind_of?(Hash)
>
>
>  --
>  Ken (Chanoch) Bloom. PhD candidate. Linguistic Cognition Laboratory.
>  Department of Computer Science. Illinois Institute of Technology.
>  http://www.iit.edu/~kbloom1/
>
>