8.2. Syntax of search queries

query -> [ subject ]? [ op ]? [ value ]?

subject -> [ ancestors ]? simple_subject

ancestors -> [ name '/']+

simple_subject -> element | attribute |
                  processing-instruction | comment

element -> name

attribute -> '@'name

processing-instruction -> 'processing-instruction(' target ')'

comment -> 'comment()'

name -> local_name | 
        prefix ':' local_name | 
        '{' [ namespace ]? '}' local_name

local_name -> NCName | '*'

prefix -> NCName | '*'

namespace -> anyURI | '*'

target -> NCName | '*'

op -> '=*' | '=' | '=~'

value -> plain_text_or_regular_expression

The default subject is: any element.

The default op is: =*.

The default value is: any value.

OpDescription
=*The textual content of the subject contains the searched value.
=The textual content of the subject is equal to the searched value.
=~

The textual content of the subject contains a substring matching the searched value, which is a regular expression.

The supported syntax for regular expressions is documented here.

Examples:

  • Find documents containing elements containing substring "XXE": =* XXE or more simply XXE

  • Find documents containing attributes containing substring "XXE": @* =* XXE

  • Find documents containing literal elements containing a text equal to "XXE": literal = XXE

  • Find documents containing table elements having an xml:id attribute: table/@xml:id =

  • Find documents containing comments: comment() =

  • Find documents containing the <?xxe-relaxng-schema> processing-instruction: processing-instruction(xxe-relaxng-schema) =

  • Find documents containing absolute HTML links: a/@href =~ ^http://