Are XPath injections possible?

[Marc Speck <ma...@gmail.com>]

I'm not an expert for XPath (in Jackrabbit) but taken the nature of SQL
injections, I suspect that similar attacks in XPath are possible? I've just
browsed org.apache.jackrabbit.commons.query.GQL and saw in parse() that you
escape [, !, etc. Is there an escape method for user generated queries in
Jackrabbit or do you recommend to use GQL once it's out?

Thanks,
Marc

Re: Are XPath injections possible?

[Marcel Reutegger <ma...@gmx.net>]

Hi Marc,

speaking of JSR 283... it will also allow you to create prepared queries with
variables that you can bind values to.

regards
 marcel

Marc Speck wrote:
> Hi Alex
> 
> Thanks for the quick response.
> 
> 1) JCR SQL and XPath are read-only (not DROP table attacks)
> 
> Indeed, that makes it much more secure.
> 
> 
>> 2) XPath syntax is much more specific, so you cannot easily add
>> another statement in an injection
> 
> "cannot easily add" is not very reassuring in a security context ;-)
> But taken 1), the worst thing that could happen is that the user gets more
> results. Providing ACL in jsr283 is going to work fine, the user has no
> access to hidden information.
> 
> 
>>
>> http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/util/Text.java?view=markup
> 
> Thanks for that, didn't know.
> 
> Marc
> 

Re: Are XPath injections possible?

[Marc Speck <ma...@gmail.com>]

>
>
> speaking of JSR 283... it will also allow you to create prepared queries
> with
> variables that you can bind values to.
>

Thank's for the pointer, I didn't know.


> >> 2) XPath syntax is much more specific, so you cannot easily add
> >> another statement in an injection
> >
> > "cannot easily add" is not very reassuring in a security context ;-)
>
>
I actually meant "cannot add" ;-) An Xpath query is one single query only.


Yeah, I thought that you wanted to say that...



> > But taken 1), the worst thing that could happen is that the user gets
> more
> > results. Providing ACL in jsr283 is going to work fine, the user has no
> > access to hidden information.
>
>
> Correct. Although you could have that with JCR 1.0 alredy, too. You
> would "just" have to implement access control restrictions in
> Jackrabbit (write an AccessManager). It is already proven in a
> commercial JCR repository (CRX).
>

Implementing such a basic security component makes me somewhat nervous. As
far as I know, there is already a first implementation in the trunk. I can
wait for that and go from there.

Thanks for all the comments,
Marc

Re: Are XPath injections possible?

[Alexander Klimetschek <ak...@day.com>]

On Mon, Aug 25, 2008 at 4:51 PM, Marc Speck <ma...@gmail.com> wrote:
>> 2) XPath syntax is much more specific, so you cannot easily add
>> another statement in an injection
>
> "cannot easily add" is not very reassuring in a security context ;-)

I actually meant "cannot add" ;-) An Xpath query is one single query only.

> But taken 1), the worst thing that could happen is that the user gets more
> results. Providing ACL in jsr283 is going to work fine, the user has no
> access to hidden information.

Correct. Although you could have that with JCR 1.0 alredy, too. You
would "just" have to implement access control restrictions in
Jackrabbit (write an AccessManager). It is already proven in a
commercial JCR repository (CRX).

Regards,
Alex

-- 
Alexander Klimetschek
alexander.klimetschek@day.com

Re: Are XPath injections possible?

[Marc Speck <ma...@gmail.com>]

Hi Alex

Thanks for the quick response.

1) JCR SQL and XPath are read-only (not DROP table attacks)

Indeed, that makes it much more secure.


> 2) XPath syntax is much more specific, so you cannot easily add
> another statement in an injection

"cannot easily add" is not very reassuring in a security context ;-)
But taken 1), the worst thing that could happen is that the user gets more
results. Providing ACL in jsr283 is going to work fine, the user has no
access to hidden information.


>
>
> http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/util/Text.java?view=markup

Thanks for that, didn't know.

Marc

Re: Are XPath injections possible?

[Alexander Klimetschek <ak...@day.com>]

The problem is much less critical in Jackrabbit due to the following reasons:

1) JCR SQL and XPath are read-only (not DROP table attacks)
2) XPath syntax is much more specific, so you cannot easily add
another statement in an injection (mostly you will have variable
replacement only inside predicates)
3) Mostly you will use the JCR API to look up things and use queries
more for full-text searches (I know, this one is not a good argument,
but at least this describes the typical JCR usage ;-))

The jackrabbit-jcr-commons jar contains some helper classes for
escaping and converting, eg. org.apache.jackrabbit.util.Text with
escape()/unescape() of JCR names (to get valid node names):

http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/util/Text.java?view=markup

Not sure where to find other kinds of Xpath escaping...

Regards,
Alex

On Mon, Aug 25, 2008 at 9:41 AM, Marc Speck <ma...@gmail.com> wrote:
> I'm not an expert for XPath (in Jackrabbit) but taken the nature of SQL
> injections, I suspect that similar attacks in XPath are possible? I've just
> browsed org.apache.jackrabbit.commons.query.GQL and saw in parse() that you
> escape [, !, etc. Is there an escape method for user generated queries in
> Jackrabbit or do you recommend to use GQL once it's out?
>
> Thanks,
> Marc
>



-- 
Alexander Klimetschek
alexander.klimetschek@day.com