How to prevent the implementation of XPath / XML in .NET.

Question

How can I prevent XPATH implementation in the .NET Framework?

Previously, we used string concatenation to create XPATH instructions, but found that end users can execute arbitrary XPATHs. For instance:

string queryValue = "pages[@url='" + USER_INPUT_VALUE + "']"; node = doc.DocumentElement.SelectSingleNode(queryValue); 

Would it be sufficient to exclude single and double quotes from input strings?

Or is .NET support supported in parameterized XPATH queries?

Answer 1

The main idea of ​​preventing XPath implementation is to precompile the XPath expression that you want to use and enable the variables (parameters) in it that will be replaced by user-entered values ​​during the evaluation process .

In .NET :

• You have an XPath expression precompiled with XPathExpression.Compile () .

• Use the XPathExpression.SetContext () Method to specify an XsltContext as the context that resolves defined variables to user-entered values.

You can learn more about how to evaluate an XPath expression that contains variables here .

This text contains good and complete examples.

Answer 2

Strongly typed options are available if you use the full-blown XsltTransform .

Answer 3

Parameterized XPath is possible if you use Saxon as an XPath processor.

Answer 4

Instead of strongly typed parameters, you can reduce the parameters for the user. Why give them full control if you don't want to?

Provide the user with a couple of choices and then create a query.

Allowing the user to enter any line asks for problems or a lot of work.