Xpath Injection in Adonisjs with Dynamodb

XPath Injection occurs when untrusted input is concatenated into an XPath expression without proper sanitization or parameterization. In AdonisJS, this typically arises when developers build XPath queries dynamically to query data stores. While AdonisJS is a Node.js framework and does not natively support DynamoDB as a query language, it can interact with AWS DynamoDB via the AWS SDK. If an application uses XPath-like filtering logic on data retrieved from DynamoDB (for example, filtering items client-side using string-based XPath expressions constructed from user input), injection can occur through malformed or malicious input that alters the intended selection logic.

The risk is introduced when user-controlled data is embedded into XPath expressions that are evaluated against XML or JSON-like structures derived from DynamoDB items. For instance, consider an endpoint that accepts a username parameter and uses it to build an XPath string to filter user data fetched from a DynamoDB table storing XML representations of user profiles. An attacker could supply ' or '1'='1 or a crafted payload like admin' or 1=1 to manipulate the XPath evaluation, potentially bypassing intended filters and accessing unauthorized data.

Because DynamoDB itself does not use XPath, the vulnerability is not in the database query layer but in the application logic that interprets user input as part of an XPath expression. This typically occurs during post-processing of DynamoDB scan or query results when the application performs client-side filtering using XPath libraries. If those expressions are built via string concatenation, the application becomes susceptible to classic injection patterns, including data exfiltration or privilege escalation.

In the context of middleBrick’s checks, this behavior may be flagged under the Input Validation and Property Authorization checks, especially if the constructed XPath expressions are derived from unvalidated parameters. The scanner tests whether injected expressions can alter the intended outcome, such as retrieving additional items or bypassing authorization checks. Findings include evidence of successful injection and guidance to refactor the logic to avoid dynamic XPath construction.

Remediation focuses on eliminating dynamic XPath construction and ensuring all filtering is performed using safe, parameterized methods. Since DynamoDB queries rely on key conditions and filter expressions that are not XPath-based, the best practice is to avoid XPath entirely when working with DynamoDB results. Instead, use DynamoDB’s native filtering capabilities and validate all inputs before use.

Secure DynamoDB Query Pattern in AdonisJS

Use the AWS SDK for JavaScript with parameterized queries. Never concatenate user input into expression strings.

const { DynamoDBClient, QueryCommand } = require('@aws-sdk/client-dynamodb');
const ddbClient = new DynamoDBClient({ region: 'us-east-1' });

async function getUserByStatus(status) {
  const params = {
    TableName: 'Users',
    KeyConditionExpression: 'userId = :uid',
    FilterExpression: 'status = :status',
    ExpressionAttributeValues: {
      ':uid': { S: 'user123' },
      ':status': { S: status } // status is validated against an allowlist
    }
  };

  const command = new QueryCommand(params);
  const response = await ddbClient.send(command);
  return response.Items;
}

In this example, status is supplied by the caller but should be validated against a strict allowlist (e.g., 'active', 'inactive') before being passed to DynamoDB. This prevents injection through unexpected values and aligns with the principle of least privilege.

Avoiding XPath in Application Logic

If you are working with XML data derived from DynamoDB, do not construct XPath expressions using string concatenation. Instead, use a robust XML parser and traverse the document structure programmatically.

const parseString = require('xml2js').parseString;

async function processXmlItem(xmlString, allowedType) {
  return new Promise((resolve, reject) => {
    parseString(xmlString, (err, result) => {
      if (err) return reject(err);
      const items = result.root.item || [];
      const filtered = items.filter(item => {
        const type = item.type?.[0];
        return type && type === allowedType; // strict equality check
      });
      resolve(filtered);
    });
  });
}

This approach avoids XPath evaluation entirely and uses typed comparisons to ensure only expected data is processed. It also helps meet findings from middleBrick’s LLM/AI Security and Input Validation checks by ensuring data handling is predictable and safe.

Input Validation and Allowlisting

Apply strict input validation on any parameter used in data retrieval. For example, use schema validation (e.g., with Joi or AdonisJS Validator) to ensure values conform to expected formats.

const schema = Joi.object({
  filterType: Joi.string().valid('public', 'private', 'internal').required()
});

const { error, value } = schema.validate({ filterType: request.input('type') });
if (error) {
  throw new Error('Invalid filter type');
}
// Use value.filterType safely in DynamoDB FilterExpression or client-side logic