JavaScript : XPath injection