security_rust/injection/
xpath_injection.rs

1// Copyright (c) 2026 erik <erik@erik.xyz> — https://erik.xyz
2
3use crate::{AttackCategory, DetectionResult, Detector, Severity, regex_detect};
4use regex::Regex;
5use std::sync::LazyLock;
6
7static PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
8    vec![
9        Regex::new(r"'(?i)\s*or\s*'1'\s*=\s*'1").unwrap(),
10        Regex::new(r"'(?i)\s*and\s*'1'\s*=\s*'2").unwrap(),
11        Regex::new(r"'(?i)\s*or\s*1\s*=\s*1").unwrap(),
12        Regex::new(r#""(?i)\s*or\s*"1"\s*=\s*"1"#).unwrap(),
13        Regex::new(r"'\s*\]\s*\|\s*").unwrap(),
14        Regex::new(r"'(?i)\s*or\s*''='").unwrap(),
15        Regex::new(r"'(?i)\s*or\s*true\s*\(").unwrap(),
16    ]
17});
18
19pub struct XPathInjectionDetector;
20
21impl Detector for XPathInjectionDetector {
22    fn name(&self) -> &'static str {
23        "xpath_injection"
24    }
25
26    fn detect(&self, input: &str) -> Option<DetectionResult> {
27        regex_detect(
28            &PATTERNS,
29            self.name(),
30            AttackCategory::Injection,
31            Severity::High,
32            "XPATH injection detected",
33            input,
34        )
35    }
36}
37
38#[cfg(test)]
39mod tests {
40    use super::*;
41
42    fn det() -> XPathInjectionDetector {
43        XPathInjectionDetector
44    }
45
46    fn assert_hit(input: &str) {
47        crate::test_helpers::assert_detected(
48            &det(),
49            input,
50            AttackCategory::Injection,
51            Severity::High,
52        );
53    }
54
55    #[test]
56    fn name_is_xpath_injection() {
57        assert_eq!(det().name(), "xpath_injection");
58    }
59
60    #[test]
61    fn detects_common_payloads() {
62        for input in [
63            "' or '1'='1",
64            "' or 1=1",
65            "' and '1'='2",
66            r#"" or "1"="1"#,
67            "' or ''='",
68            "' or true()",
69            "']|//admin",
70        ] {
71            assert_hit(input);
72        }
73    }
74
75    #[test]
76    fn benign_inputs_not_detected() {
77        for input in [
78            "Hello, this is a normal text input. Nothing suspicious here.",
79            "The first quarter results are in",
80            "or is a conjunction in English",
81            "I want 1 pizza and 1 drink",
82        ] {
83            assert!(det().detect(input).is_none(), "false positive: {input}");
84        }
85    }
86
87    #[test]
88    fn edge_cases() {
89        assert!(det().detect("").is_none());
90        assert!(det().detect(" \t\n ").is_none());
91        assert!(det().detect("你好世界 こんにちは").is_none());
92        // near misses: quote missing or condition not satisfied
93        assert!(det().detect("or 1=1").is_none());
94        assert!(det().detect("' or '2'='1").is_none());
95        assert!(det().detect("' or 2=2").is_none());
96    }
97
98    #[test]
99    fn obfuscated_variants_detected() {
100        for input in ["' OR '1'='1", "' And '1'='2", r#"" Or "1"="1"#] {
101            assert_hit(input);
102        }
103    }
104}
security_rust/injection/xpath_injection.rs

security_rust/injection/
xpath_injection.rs
