XPath injection
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways. This might grant the attacker access to any data, not just the data that the original query intended.
from flask import request, app


@app.route('/user')
def find_users_noncompliant():
    from flask import request
    import xml.etree.ElementTree as ET
    tree = ET.parse('users.xml')
    root = tree.getroot()
    username = request.args['username']
    query = "./users/user/[@name='"+username+"']/location"
    # Noncompliant: evaluating expression built from user-supplied parameter
    # can lead to XPath injection.
    elements = root.findall(query)
    return 'Location %s' % list(elements)
from flask import request, app


@app.route('/user')
def find_users_compliant():
    from flask import request
    from lxml import etree
    # Compliant: disabling external entities prevents XPath injection.
    parser = etree.XMLParser(resolve_entities=False)
    tree = etree.parse('users.xml', parser)
    root = tree.getroot()
    username = request.args['username']
    query = "/collection/users/user[@name = $parameter_name]/location/text()"
    elements = root.xpath(query, parameter_name=username)
    return 'Location %s' % list(elements)