new capacity bits (#67)

tests/fixtures/xpath_injection/cpp/unsafe_xpath_query.cpp

@@ -0,0 +1,9 @@
+// Unsafe: tainted env-string passed straight as the XPath expression to
+// xmlXPathEvalExpression.  XPATH_INJECTION fires on the expression arg.
+#include <libxml/xpath.h>
+#include <cstdlib>
+
+xmlXPathObjectPtr do_lookup(xmlXPathContextPtr ctx) {
+    char *user_expr = std::getenv("USER_EXPR");
+    return xmlXPathEvalExpression((xmlChar *)user_expr, ctx);
+}