Xpath Injection in Fastapi with Firestore

XPath Injection becomes relevant in a Fastapi application when user-influenced data is used to construct XPath expressions that are later evaluated against an XML or structured document store. Although Firestore is a document database and does not use XPath natively, an application may transform Firestore document data into XML or an in-memory structure that is queried with XPath. If user input is concatenated into the XPath without proper sanitization or parameterization, an attacker can manipulate the expression to bypass intended filters, access unintended nodes, or extract sensitive data.

In this specific combination, a Fastapi endpoint might retrieve data from Firestore, convert the JSON documents into an XML DOM, and then apply an XPath expression derived from query parameters or headers. For example, an untrusted parameter such as category could be interpolated into an XPath like /items/item[category='{user_input}']. Because Firestore rules operate at the document level and do not protect against XPath evaluation performed after data retrieval, malicious input can change the semantics of the XPath. Common XPath Injection payloads include ' or '1'='1 or ' or substring(//secret,1,1)='a, which can lead to data disclosure or privilege escalation in the constructed document tree.

The risk is compounded when the Fastapi service uses elevated service account permissions to read Firestore data, because any XPath evaluation performed server-side inherits those permissions. An attacker who can inject XPath may be able to traverse the document structure, extract fields that would normally be filtered, or cause excessive document reads that affect cost or performance. Because Firestore does not log XPath-specific behavior, such injection may not be visible in native audit trails, making detection harder. Standard input validation is insufficient; developers must treat any data used in XPath as untrusted and apply strict controls.

To prevent XPath Injection when working with Firestore data in Fastapi, avoid constructing XPath expressions through string interpolation. Instead, use parameterized XPath APIs when available, or better, avoid XPath entirely in favor of native document access patterns. When transforming Firestore data into XML is necessary, ensure that user input is never used to dynamically build paths or predicates.

Below is a secure Fastapi example that retrieves a Firestore document and transforms it into XML without exposing XPath Injection. The code uses the official Google Cloud Firestore client and the xml.etree.ElementTree module to build XML safely. User input is used only as a key to fetch a specific document, not as part of an XPath expression.

import hashlib
import xml.etree.ElementTree as ET
from fastapi import FastAPI, HTTPException, Query
from google.cloud import firestore
from pydantic import BaseModel

app = FastAPI()
db = firestore.Client()

class Item(BaseModel):
    id: str
    category: str
    value: str

@app.get("/items/{item_id}", response_model=Item)
async def read_item(
    item_id: str = Query(..., min_length=1, pattern=r'^[A-Za-z0-9_-]{1,64}$')
):
    # Fetch document by ID; ID is validated before use
    doc_ref = db.collection("items").document(item_id)
    doc = doc_ref.get()
    if not doc.exists:
        raise HTTPException(status_code=404, detail="Item not found")
    data = doc.to_dict()
    return Item(id=item_id, **data)

@app.get("/items/export")
async def export_items(category: str = Query(..., min_length=1)):
    # Use parameterized query patterns, not XPath
    items_ref = db.collection("items").where("category", "==", category)
    snapshot = items_ref.stream()
    root = ET.Element("items")
    for doc in snapshot:
        item_elem = ET.SubElement(root, "item")
        for key, val in doc.to_dict().items():
            child = ET.SubElement(item_elem, key)
            child.text = str(val)
    xml_str = ET.tostring(root, encoding="unicode")
    return {"xml": xml_str}

If your workflow requires XPath evaluation over transformed data, use a library that supports parameterized expressions. For example, with lxml, prefer .xpath('//item[category=$cat]', cat=user_value) over string concatenation. Never pass raw user input into expression strings. Continue to enforce Firestore-level security rules, and consider using the middleBrick CLI to scan endpoints for injection risks as part of your development workflow.