nyx/tests/fixtures/xpath_injection/python/baseline_constant_xpath.py
2026-05-07 01:29:31 -04:00

8 lines
243 B
Python

# Baseline: expression is a compile-time constant. No taint reaches
# `tree.xpath` so no XPATH_INJECTION finding fires.
from lxml import etree
def lookup():
tree = etree.parse("users.xml")
return tree.xpath("//user[@role='admin']")