apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-24 20:28:06 +02:00
Code Issues Projects Releases Packages Wiki Activity

new capacity bits (#67)

Browse source
This commit is contained in:
Eli Peter 2026-05-07 01:29:31 -04:00 • committed by GitHub
parent afaffc0df6
commit 7d0e7320e2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
261 changed files with 10591 additions and 231 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tests/fixtures/xpath_injection/php/safe_xpath_query.php vendored Normal file
View file

@ -0,0 +1,13 @@
<?php
// Safe: $_GET['user'] routed through the project-local `escape_xpath` helper
// before concatenation. The sanitizer clears XPATH_INJECTION so the sink
// does not fire.
function escape_xpath($raw) {
return str_replace(["'", "\""], ["&apos;", "&quot;"], $raw);
}
$xml = simplexml_load_file("users.xml");
$user = $_GET['user'];
$safe = escape_xpath($user);
$expr = "//user[name='" . $safe . "']";
$nodes = $xml->xpath($expr);