#2305 fix xpath regex check

DavidBlaa · DavidBlaa · commit 5acb2d3c6887 · 2025-12-11T11:56:45.000+01:00
diff --git a/Components/XML/BExIS.Xml.Helpers/XmlUtility.cs b/Components/XML/BExIS.Xml.Helpers/XmlUtility.cs
@@ -22,7 +22,7 @@ public static bool IsSafeXPath(string xpath)
             // Only allow XPaths like /a/b/c or /a[1]/b matches, no function calls, no quotes, etc.
             // You can adjust the pattern according to the actual requirements.
             // This only allows: /node1/node2/...
-            var safePattern = @"^(/[a-zA-Z_][\w\-]*(\[\d+\])?)*$";
+            var safePattern = @"^(/?/?[a-zA-Z_][\w\-]*(\[\d+\])?)*$";
             return System.Text.RegularExpressions.Regex.IsMatch(xpath, safePattern);
         }
 

Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,7 @@ public static bool IsSafeXPath(string xpath)`
`22`	`22`	`// Only allow XPaths like /a/b/c or /a[1]/b matches, no function calls, no quotes, etc.`
`23`	`23`	`// You can adjust the pattern according to the actual requirements.`
`24`	`24`	`// This only allows: /node1/node2/...`
`25`		`- var safePattern = @"^(/[a-zA-Z_][\w\-](\[\d+\])?)$";`
	`25`	`+ var safePattern = @"^(/?/?[a-zA-Z_][\w\-](\[\d+\])?)$";`
`26`	`26`	`return System.Text.RegularExpressions.Regex.IsMatch(xpath, safePattern);`
`27`	`27`	`}`
`28`	`28`