Xpath injection

[cgocast]

The following functions are vulnerable to Xpath injection as explained at https://owasp.org/www-community/attacks/XPATH_Injection

function queryXmlExpression(SimpleXMLElement $xml) : array|false|null {
    $expression = $_GET["expression"];
    return $xml->xpath($expression);
}       

function queryDomExpression(DOMXPath $xpath) : mixed {
    $expression = $_GET["expression"];
    return $xpath->query($expression);
}         

function evaluateDomExpression(DOMXPath $xpath) : mixed {
    $expression = $_GET["expression"];
    return $xpath->evaluate($expression);
}

Psalm returns no issue when run with --taint-analysis.

I'll write a PR in order to raise a new issue named TaintedXpath

[psalm-github-bot]

Hey @cgocast, can you reproduce the issue on https://psalm.dev ?

[cgocast]

Fixed by #10163