Rule Definition
The software does not properly neutralize special elements that are used in an XQuery expression, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Remediation
Use authorized sanitization methods.

Violation Code Sample

...
String login = resultSet.getString(1);
XQDataSource dataSource = new SaxonXQDataSource();
XQConnection xcon = dataSource.getConnection(connectionName, connectionPassword);
String xquery = "for $user in doc(\"base.xml\")/Users/User[login='" + login + "'] return $user/password";
XQPreparedExpression xqpe = xcon.prepareExpression(xquery);
XQResultSequence rs = xqpe.executeQuery();
...

Fixed Code Sample

...
String login = resultSet.getString(1);
XQDataSource dataSource = new SaxonXQDataSource();
XQConnection xcon = dataSource.getConnection(connectionName, connectionPassword);
String xquery = "for $user in doc(\"base.xml\")/Users/User[login='$login'] return $user/password";
XQPreparedExpression xqpe = xcon.prepareExpression(xquery);
xqpe.bindString(new QName("login"), login, null);
XQResultSequence rs = xqpe.executeQuery();
...

CWE-652: XQuery Injection https://cwe.mitre.org/data/definitions/652.html