What Happened to XPath?
XPath post 1.0 got ridiculous, like many things do. What started with a simple, elegant language morphed into one with a http client, filesystem methods, json support, functions, loops, extensions and the ability to read environment variables.<p>I wrote a post about it a while back[1] (I regret some of the wording used there) and maintain a tool[2]  that can exploit XPath injection issues. I&#x27;d recommend sticking with 1 or <i>maybe</i> 2, and pretending 3.x doesn&#x27;t exist.<p>1. <a href="https:&#x2F;&#x2F;tomforb.es&#x2F;xcat-1.0-released-or-xpath-injection-issues-are-severely-underrated&#x2F;" rel="nofollow">https:&#x2F;&#x2F;tomforb.es&#x2F;xcat-1.0-released-or-xpath-injection-issu...</a><p>2. <a href="https:&#x2F;&#x2F;github.com&#x2F;orf&#x2F;xcat" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;orf&#x2F;xcat</a>