nyx/tests/fixtures/xpath_injection/ruby/unsafe_xpath_query.rb
2026-05-07 01:29:31 -04:00

11 lines
342 B
Ruby

# Unsafe: Sinatra params concatenated into an XPath expression and passed to
# Nokogiri's `xpath` method. Suffix matching on `xpath` catches the
# bound-receiver call directly.
require 'nokogiri'
def lookup(params)
doc = Nokogiri::XML(File.read("users.xml"))
user = params[:user]
expr = "//user[name='#{user}']"
doc.xpath(expr)
end