SEC016
XML injection via concatenation
Object Pascal — Delphi & Free Pascal
Warning
Security
Building XML by concatenation allows injection of malicious elements
building XML by concatenation allows injection of malicious elements.
Why this severity
building XML by concatenation allows injection of malicious elements.
Known false positives
constant XML fragments with no user-controlled content.
Remediation example
Doc := TXMLDocument.Create(nil);
Node := Doc.AddChild('item');
Node.Text := UserInput;