Potential fix for code scanning alert no. 6: XPath injection

XPath Injection fix for:  src/main/java/org/owasp/benchmark/testcode/Benchmark00207.java:74

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: davewichers

src/main/java/org/owasp/benchmark/testcode/Benchmark00207.java

@@ -71,7 +71,17 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
             javax.xml.xpath.XPathFactory xpf = javax.xml.xpath.XPathFactory.newInstance();
             javax.xml.xpath.XPath xp = xpf.newXPath();
 
-            String expression = "/Employees/Employee[@emplid='" + bar + "']";
+            String expression = "/Employees/Employee[@emplid=$emplid]";
+            xp.setXPathVariableResolver(
+                    new javax.xml.xpath.XPathVariableResolver() {
+                        @Override
+                        public Object resolveVariable(javax.xml.namespace.QName variableName) {
+                            if ("emplid".equals(variableName.getLocalPart())) {
+                                return bar;
+                            }
+                            return null;
+                        }
+                    });
             String result = xp.evaluate(expression, xmlDocument);
 
             response.getWriter().println("Your query results are: " + result + "<br/>");