Xpath Injection in Fiber with Firestore

Xpath Injection occurs when user-controlled data is concatenated into XPath expressions without proper sanitization or parameterization, leading to unauthorized data access or authentication bypass. In a Fiber application that uses Firestore as a backend, this typically arises when building dynamic queries from request parameters that influence path-based selection or filtering. While Firestore itself does not use XPath, an application layer may construct XPath-like selectors for in-memory transformations, document filtering logic, or integration with legacy XML-based services that interface with Firestore data.

Consider a scenario where an API endpoint in Fiber accepts a user-supplied identifier to retrieve a user profile stored in Firestore. If the server uses this input to build an XPath expression for downstream processing (e.g., querying an attached XML store or transforming Firestore documents into XML for legacy systems), unsanitized input can alter the expression’s structure. For example, a user providing admin' or '1'='1 as a user ID could shift the logic to bypass intended filters. Even though Firestore queries remain parameterized, the vulnerability exists in the translation layer between Firestore results and XPath usage, especially when those results are re-expressed in XML formats for external consumption.

Because middleBrick scans the unauthenticated attack surface, it can detect patterns where XPath expressions are assembled using string concatenation with external inputs. The tool flags insecure usage such as direct interpolation of request parameters into selectors, highlighting risks of data exposure or unauthorized traversal. This is particularly relevant when Firestore documents are exported or mirrored into XML structures for integration purposes, as the XPath logic then inherits the security properties of the surrounding application code.

In a CI/CD context, using the middleBrick GitHub Action to fail builds when such patterns are detected can prevent these issues from reaching production. Developers gain visibility into how external inputs interact with selection logic, even when the primary database interface, like Firestore, remains safely parameterized.

To mitigate Xpath Injection risks in a Fiber application interfacing with Firestore, avoid constructing XPath expressions using raw user input. Instead, rely on Firestore’s native parameterized queries and enforce strict input validation before any transformation occurs.

Below is a secure Fiber handler that retrieves a user document by ID and, if necessary, converts the result into XML for legacy processing without exposing XPath injection surfaces.

package main

import (
	"context"
	"fmt"
	"net/http"
	"strings"

	"github.com/gofiber/fiber/v2"
	"cloud.google.com/go/firestore"
	"google.golang.org/api/iterator"
)

type User struct {
	ID    string `firestore:"id"`
	Name  string
	Email string
}

func getUserProfile(c *fiber.Ctx) error {
	userID := c.Params("userID")
	if userID == "" {
		return c.Status(http.StatusBadRequest).JSON(fiber.Map{"error": "missing userID"})
	}

	// Input validation: allow only alphanumeric and safe identifiers
	if !isValidUserID(userID) {
		return c.Status(http.StatusBadRequest).JSON(fiber.Map{"error": "invalid user identifier"})
	}

	ctx := context.Background()
	client, err := firestore.NewClient(ctx, "your-project-id")
	if err != nil {
		return c.Status(http.StatusInternalServerError).JSON(fiber.Map{"error": "failed to create client"})
	}
	defer client.Close()

	// Use Firestore parameterized get — safe from injection
	doc, err := client.Collection("users").Doc(userID).Get(ctx)
	if err != nil || doc.Data() == nil {
		return c.Status(http.StatusNotFound).JSON(fiber.Map{"error": "user not found"})
	}

	var user User
	if err := doc.DataTo(&user); err != nil {
		return c.Status(http.StatusInternalServerError).JSON(fiber.Map{"error": "failed to parse user"})
	}

	// Safe XML generation without XPath interpolation
	xmlOutput := fmt.Sprintf("<user><id>%s</id><name>%s</name><email>%s</email></user>",
		escapeXML(user.ID), escapeXML(user.Name), escapeXML(user.Email))

	return c.SendString(xmlOutput)
}

func isValidUserID(id string) bool {
	// Allow only alphanumeric and underscores
	for _, r := range id {
		if !(r == '_' || (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9')) {
			return false
		}
	}
	return true
}

func escapeXML(s string) string {
	s = strings.ReplaceAll(s, &#34;&&, &#34;&amp;&amp;&#34;)
	s = strings.ReplaceAll(s, &#34;&lt;&#34;, &#34;&amp;lt;&#34;)
	s = strings.ReplaceAll(s, &#34;&gt;&#34;, &#34;&amp;gt;&#34;)
	return s
}

This approach ensures Firestore queries remain parameterized and any downstream XML generation avoids string interpolation of user input, effectively neutralizing XPath Injection vectors. The validation function restricts identifiers to a safe character set, reducing attack surface.

For continuous protection, the middleBrick CLI can be integrated into development workflows to scan API endpoints for similar patterns. The Pro plan’s continuous monitoring can alert teams when risky string-building patterns reappear in updated code, supporting long-term maintenance without requiring manual review of every change.