Synopsis

(Required) The validity of values received from external sources shall be checked.

Enabled by default

Yes

Severity/Certainty

Medium/Medium

Full description

User input is improperly used as an XPath expression.

Coding standards

Code examples

The following code example fails the check and will give a warning:

#include <string.h>

void example(void * xml) {
  char *name;
  char *xpath;
  name = gets(name);
  strcpy(xpath, "children::*[@name = '");
  strcat(xpath, name);
  strcat(xpath, "'");
  xmlXPathEval(xml, xpath);
}

The following code example passes the check and will not give a warning about this issue:

#include <string.h>

void example(void * xml, char *name) {
  char *xpath;
  strcpy(xpath, "children::*[@name = '");
  strcat(xpath, name);
  strcat(xpath, "'");
  xmlXPathEval(xml, xpath);
}