# Documentation Patch: Preventing XPath Injection attacks **URL:** \ **Category:** Ruby\ **Created:** [April 29, 2008, 4:15pm UTC](https://www.ruby-forum.com/t/documentation-patch-preventing-xpath-injection-attacks/136167 "2008-04-29T16:15:47Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sevensoft](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f9ae1b/32.png) [@sevensoft](https://www.ruby-forum.com/u/sevensoft)\ **Post date:** [April 29, 2008, 4:15pm UTC](https://www.ruby-forum.com/t/documentation-patch-preventing-xpath-injection-attacks/136167/1 "2008-04-29T16:15:47Z")
Here’s a patch to rexml/xpath.rb which documents the variables parameter in REXML::XPath. — xpath.rb.old 2008-04-24 17:31:51.000000000 -0500 +++ xpath.rb 2008-04-24 17:37:38.000000000 -0500 @@ -15,10 +15,15 @@ # node matching ‘\*’. # namespaces:: # If supplied, a Hash which defines a namespace mapping. - # variables:: - # If supplied, a Hash which maps $variables in the query - # to values. This can be used to avoid XPath injection attacks - # or to automatically handle escaping string values. # # XPath.first( node ) # XPath.first( doc, “//b”} ) # XPath.first( node, “a/x:b”, { “x”=\>“[http://doofus](http://doofus)” } ) - # XPath.first( node, ‘/book/publisher/text()=$publisher’, {}, {“publisher”=\>“O’Reilly”}) def XPath::first element, path=nil, namespaces=nil, variables={} raise “The namespaces argument, if supplied, must be a hash object.” unless namespaces.nil? or namespaces.kind\_of?(Hash) raise “The variables argument, if supplied, must be a hash object.” unless variables.kind\_of?(Hash) @@ -38,10 +43,16 @@ # The xpath to search for. If not supplied or nil, defaults to ‘\*’ # namespaces:: # If supplied, a Hash which defines a namespace mapping - # variables:: - # If supplied, a Hash which maps $variables in the query - # to values. This can be used to avoid XPath injection attacks - # or to automatically handle escaping string values. # # XPath.each( node ) { |el| … } # XPath.each( node, ‘/\*[@attr=‘v’]’ ) { |el| … } # XPath.each( node, ‘ancestor::x’ ) { |el| … } - # XPath.each( node, ‘/book/publisher/text()=$publisher’, {}, {“publisher”=\>“O’Reilly”}) \ - # {|el| … } def XPath::each element, path=nil, namespaces=nil, variables={}, &block raise “The namespaces argument, if supplied, must be a hash object.” unless namespaces.nil? or namespaces.kind\_of?(Hash) raise “The variables argument, if supplied, must be a hash object.” unless variables.kind\_of?(Hash) ---
**Author:** ![sevensoft](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f9ae1b/32.png) [@sevensoft](https://www.ruby-forum.com/u/sevensoft)\ **Post date:** [April 29, 2008, 7:11pm UTC](https://www.ruby-forum.com/t/documentation-patch-preventing-xpath-injection-attacks/136167/2 "2008-04-29T19:11:59Z")
may want to send that to ruby-core 🙂 -R ---
**Author:** ![sevensoft](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f9ae1b/32.png) [@sevensoft](https://www.ruby-forum.com/u/sevensoft)\ **Post date:** [April 30, 2008, 5:11am UTC](https://www.ruby-forum.com/t/documentation-patch-preventing-xpath-injection-attacks/136167/3 "2008-04-30T05:11:00Z")
On Tue, 29 Apr 2008 12:11:10 -0500, Roger P. wrote: > may want to send that to ruby-core 🙂 -R Could somebody else do that for me? (Maybe Matz will notice the patch here.) I can’t seem to get an email through to ruby-core or ruby-doc for reasons that are completely beyond me. –Ken ---
**Author:** ![sevensoft](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f9ae1b/32.png) [@sevensoft](https://www.ruby-forum.com/u/sevensoft)\ **Post date:** [April 30, 2008, 4:12pm UTC](https://www.ruby-forum.com/t/documentation-patch-preventing-xpath-injection-attacks/136167/4 "2008-04-30T16:12:44Z")
On Tue, 29 Apr 2008 22:52:35 -0500, Phillip G. wrote: > Try to subscribe with @googlemail.com, instead of @gmail.com. > > That fixes this sort of issue for me, usually. Ok. I didn’t know I needed to be subscribed, and gmail ate the bounce messages. –Ken ---
**Author:** ![sevensoft](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f9ae1b/32.png) [@sevensoft](https://www.ruby-forum.com/u/sevensoft)\ **Post date:** [April 30, 2008, 5:53am UTC](https://www.ruby-forum.com/t/documentation-patch-preventing-xpath-injection-attacks/136167/5 "2008-04-30T05:53:03Z")
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ken B. wrote: | On Tue, 29 Apr 2008 12:11:10 -0500, Roger P. wrote: | |\> may want to send that to ruby-core 🙂 -R | | Could somebody else do that for me? (Maybe Matz will notice the patch | here.) I can’t seem to get an email through to ruby-core or ruby-doc for | reasons that are completely beyond me. Try to subscribe with @googlemail.com, instead of @gmail.com. That fixes this sort of issue for me, usually. * * * Phillip G. Twitter: [twitter.com/cynicalryan](http://twitter.com/cynicalryan) Blog: [http://justarubyist.blogspot.com](http://justarubyist.blogspot.com) ~ “Mom and dad say I should make my life an example of the principles I ~ believe in. But every time I do, they tell me to stop it.” ~ — Calvin -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (MingW32) Comment: Using GnuPG with Mozilla - [http://enigmail.mozdev.org](http://enigmail.mozdev.org) iEYEARECAAYFAkgX7QAACgkQbtAgaoJTgL9gfgCfXY5eUH1BOW/MVqK5EVrn5CrI 7FAAn3qOKx3JGyGAVtO8MRIr40YPC0Hy =+vzH -----END PGP SIGNATURE----- ---
**Author:** ![sevensoft](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f9ae1b/32.png) [@sevensoft](https://www.ruby-forum.com/u/sevensoft)\ **Post date:** [April 30, 2008, 4:13pm UTC](https://www.ruby-forum.com/t/documentation-patch-preventing-xpath-injection-attacks/136167/6 "2008-04-30T16:13:55Z")
On Tue, 29 Apr 2008 22:52:35 -0500, Phillip G. wrote: > Try to subscribe with @googlemail.com, instead of @gmail.com. > > That fixes this sort of issue for me, usually. I don’t need to be subscribed to post to ruby-talk. I didn’t know I needed to be subscribed to post to ruby-doc or ruby-core. (I also haven’t gotten any bounce telling me that.) –Ken