XPath post 1.0 got ridiculous, like many things do. What started with a simple, elegant language morphed into one with a http client, filesystem methods, json support, functions, loops, extensions and the ability to read environment variables.<p>I wrote a post about it a while back[1] (I regret some of the wording used there) and maintain a tool[2] that can exploit XPath injection issues. I'd recommend sticking with 1 or <i>maybe</i> 2, and pretending 3.x doesn't exist.<p>1. <a href="https://tomforb.es/xcat-1.0-released-or-xpath-injection-issues-are-severely-underrated/" rel="nofollow">https://tomforb.es/xcat-1.0-released-or-xpath-injection-issu...</a><p>2. <a href="https://github.com/orf/xcat" rel="nofollow">https://github.com/orf/xcat</a>