66import javax .xml .xquery .XQConnection ;
77import javax .xml .xquery .XQDataSource ;
88import javax .xml .xquery .XQException ;
9+ import javax .xml .xquery .XQExpression ;
910import javax .xml .xquery .XQItemType ;
1011import javax .xml .xquery .XQPreparedExpression ;
1112import javax .xml .xquery .XQResultSequence ;
1718@ Controller
1819public class XQueryInjection {
1920
21+ public static void main (String [] args ) throws Exception {
22+ XQDataSource xqds = new SaxonXQDataSource ();
23+ XQConnection conn ;
24+ try {
25+ String name = "admin" ;
26+ String query = "declare variable $name as xs:string external;"
27+ + " for $user in doc(\" users.xml\" )/Users/User[name=$name] return $user/password" ;
28+ conn = xqds .getConnection ();
29+ XQExpression expr = conn .createExpression ();
30+ expr .bindString (new QName ("name" ), name , conn .createAtomicType (XQItemType .XQBASETYPE_STRING ));
31+ XQResultSequence result = expr .executeQuery (query );
32+ while (result .next ()){
33+ System .out .println (result .getItemAsString (null ));
34+ }
35+ } catch (XQException e ) {
36+ e .printStackTrace ();
37+ }
38+ }
39+
2040 @ RequestMapping
2141 public void testRequestbad (HttpServletRequest request ) throws Exception {
2242 String name = request .getParameter ("name" );
@@ -28,23 +48,46 @@ public void testRequestbad(HttpServletRequest request) throws Exception {
2848 while (result .next ()){
2949 System .out .println (result .getItemAsString (null ));
3050 }
51+ }
3152
53+ @ RequestMapping
54+ public void testRequestbad1 (HttpServletRequest request ) throws Exception {
55+ String name = request .getParameter ("name" );
56+ XQDataSource xqds = new SaxonXQDataSource ();
57+ String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + name + "'] return $user/password" ;
58+ XQConnection conn = xqds .getConnection ();
59+ XQExpression expr = conn .createExpression ();
60+ XQResultSequence result = expr .executeQuery (query );
61+ while (result .next ()){
62+ System .out .println (result .getItemAsString (null ));
63+ }
3264 }
3365
3466
3567 @ RequestMapping
3668 public void testStringtbad (@ RequestParam String nameStr ) throws XQException {
37- String name = nameStr ;
3869 XQDataSource ds = new SaxonXQDataSource ();
3970 XQConnection conn = ds .getConnection ();
40- String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + name + "'] return $user/password" ;
71+ String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + nameStr + "'] return $user/password" ;
4172 XQPreparedExpression xqpe = conn .prepareExpression (query );
4273 XQResultSequence result = xqpe .executeQuery ();
4374 while (result .next ()){
4475 System .out .println (result .getItemAsString (null ));
4576 }
4677 }
4778
79+ @ RequestMapping
80+ public void testStringtbad1 (@ RequestParam String nameStr ) throws XQException {
81+ XQDataSource xqds = new SaxonXQDataSource ();
82+ String query = "for $user in doc(\" users.xml\" )/Users/User[name='" + nameStr + "'] return $user/password" ;
83+ XQConnection conn = xqds .getConnection ();
84+ XQExpression expr = conn .createExpression ();
85+ XQResultSequence result = expr .executeQuery (query );
86+ while (result .next ()){
87+ System .out .println (result .getItemAsString (null ));
88+ }
89+ }
90+
4891 @ RequestMapping
4992 public void testInputStreambad (HttpServletRequest request ) throws Exception {
5093 InputStream name = request .getInputStream ();
@@ -57,6 +100,18 @@ public void testInputStreambad(HttpServletRequest request) throws Exception {
57100 }
58101 }
59102
103+ @ RequestMapping
104+ public void testInputStreambad1 (HttpServletRequest request ) throws Exception {
105+ InputStream name = request .getInputStream ();
106+ XQDataSource xqds = new SaxonXQDataSource ();
107+ XQConnection conn = xqds .getConnection ();
108+ XQExpression expr = conn .createExpression ();
109+ XQResultSequence result = expr .executeQuery (name );
110+ while (result .next ()){
111+ System .out .println (result .getItemAsString (null ));
112+ }
113+ }
114+
60115 @ RequestMapping
61116 public void testReaderbad (HttpServletRequest request ) throws Exception {
62117 InputStream name = request .getInputStream ();
@@ -70,6 +125,19 @@ public void testReaderbad(HttpServletRequest request) throws Exception {
70125 }
71126 }
72127
128+ @ RequestMapping
129+ public void testReaderbad1 (HttpServletRequest request ) throws Exception {
130+ InputStream name = request .getInputStream ();
131+ BufferedReader br = new BufferedReader (new InputStreamReader (name ));
132+ XQDataSource xqds = new SaxonXQDataSource ();
133+ XQConnection conn = xqds .getConnection ();
134+ XQExpression expr = conn .createExpression ();
135+ XQResultSequence result = expr .executeQuery (br );
136+ while (result .next ()){
137+ System .out .println (result .getItemAsString (null ));
138+ }
139+ }
140+
73141 @ RequestMapping
74142 public void good (HttpServletRequest request ) throws XQException {
75143 String name = request .getParameter ("name" );
@@ -84,4 +152,19 @@ public void good(HttpServletRequest request) throws XQException {
84152 System .out .println (result .getItemAsString (null ));
85153 }
86154 }
87- }
155+
156+ @ RequestMapping
157+ public void good1 (HttpServletRequest request ) throws XQException {
158+ String name = request .getParameter ("name" );
159+ String query = "declare variable $name as xs:string external;"
160+ + " for $user in doc(\" users.xml\" )/Users/User[name=$name] return $user/password" ;
161+ XQDataSource xqds = new SaxonXQDataSource ();
162+ XQConnection conn = xqds .getConnection ();
163+ XQExpression expr = conn .createExpression ();
164+ expr .bindString (new QName ("name" ), name , conn .createAtomicType (XQItemType .XQBASETYPE_STRING ));
165+ XQResultSequence result = expr .executeQuery (query );
166+ while (result .next ()){
167+ System .out .println (result .getItemAsString (null ));
168+ }
169+ }
170+ }
0 commit comments