mcp-server-semgrep/semgrep-rules/csharp/dotnet/security/audit/xpath-injection.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: xpath-injection
  message: XPath queries are constructed dynamically on user-controlled input. This vulnerability in code
    could lead to an XPath Injection exploitation.
  severity: ERROR
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe:
    - "CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')"
    owasp:
    - A03:2021 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection/
    - https://cwe.mitre.org/data/definitions/643.html
    subcategory:
    - vuln
    technology:
    - .net
  languages:
  - csharp
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: $T $M($INPUT,...) {...}
    - pattern: "$T $M(...) {\n  ...\n  string $INPUT;\n}\n"
  pattern-sinks:
  - pattern-either:
    - pattern: XPathExpression $EXPR = $NAV.Compile("..." + $INPUT + "...");
    - pattern: var $EXPR = $NAV.Compile("..." + $INPUT + "...");
    - pattern: XPathNodeIterator $NODE = $NAV.Select("..." + $INPUT + "...");
    - pattern: var $NODE = $NAV.Select("..." + $INPUT + "...");
    - pattern: Object $OBJ = $NAV.Evaluate("..." + $INPUT + "...");
    - pattern: var $OBJ = $NAV.Evaluate("..." + $INPUT + "...");