nyx/tests/fixtures/xpath_injection/c/unsafe_xpath_query.c
2026-05-07 01:29:31 -04:00

9 lines
357 B
C

/* Unsafe: tainted env-string passed straight as the XPath expression to
* xmlXPathEvalExpression. XPATH_INJECTION fires on the expression arg. */
#include <libxml/xpath.h>
#include <stdlib.h>
xmlXPathObjectPtr do_lookup(xmlXPathContextPtr ctx) {
char *user_expr = getenv("USER_EXPR");
return xmlXPathEvalExpression((xmlChar *)user_expr, ctx);
}