Great article!! The user should be aware of the risk of xpath injection if his code is exposed via public apis. https://owasp.org/www-community/attacks/XPATH_Injection