Find XPath injection vulnerabilities

Finds where data from an HTTP request, read through the Servlet API or bound to a Spring Web controller parameter, flows into the text of an XPath expression compiled or evaluated by javax.xml.xpath, dom4j or JDOM 2, which lets an attacker change what the query selects. Values passed through ESAPI's encodeForXPath or Apache Commons' StringEscapeUtils.escapeXml10 or escapeXml11, or parsed to a number or UUID, are not reported. XML escaping only protects a value inside a quoted string, so an escaped value placed outside quotes, as in [@id= followed by the value, is missed. Bind such values with an XPathVariableResolver instead of concatenating them into the expression.