How to prevent xml and html injection in wso2 apim using regex or other ways?

Question

In WSO2 APIM, We can use regular expression filtering to prevent xss and sql,xml,html injections.

I found that we cannot use "</" and "/>" and even "&lt"semicolon"/" and "/&gt"semicolon"".

<property name="regex" expression="get-property('regex')" value=".*'.*|.*ALTER.*|.*ALTER TABLE.*|.*ALTER VIEW.*|
.*CREATE DATABASE.*|.*CREATE PROCEDURE.*|.*CREATE SCHEMA.*|.*create table.*|.*CREATE VIEW.*|.*DELETE.*|.
*DROP DATABASE.*|.*DROP PROCEDURE.*|.*DROP.*|.*SELECT.*|.*/>.*|.*</.*|.*&#47;&gt;.*|.*&lt;&#47;.*|.*Exception in thread.*|.*#include.*|.*#exec.*|.*#echo.*|.*#config.*|/?(ancestor(-or-self)?|descendant(-or-self)?|following(-sibling))"/>

Probably, the reason is that, All body is casted to xml envelope. I put the link of code in the end.

Do you have any idea to prevent html, script, xml, sql injection in WSO2 apim?

The code of regex filtering is here.

https://github.com/wso2/carbon-apimgt/blob/master/components/apimgt/org.wso2.carbon.apimgt.gateway/src/main/java/org/wso2/carbon/apimgt/gateway/mediators/RegularExpressionProtector.java#L205

RrR- · Accepted Answer · 2024-11-09 15:52:24Z

0

Whats the APIM version used here? In newer versions of APIM, you can use Operation Policies to achieve this requirement. Please refer threat protectors documentation [1] for more information on this. You can either use inbuilt policies or create a custom policy using a sequence to achieve this requirement.

[1] - https://apim.docs.wso2.com/en/latest/design/api-security/threat-protection/gateway-threat-protectors/gateway-threat-protectors-for-api-manager/

answered Nov 9, 2024 at 15:52

RrR-

1,4403 gold badges17 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

m.feyzollahi Over a year ago

APIM version is 4.1 .

m.feyzollahi Over a year ago

This link is just about SQL-injection. Could you help for javascript and html injection?

RrR- Over a year ago

The doc shows how to configure a regex pattern to catch javascript as well

Collectives™ on Stack Overflow

How to prevent xml and html injection in wso2 apim using regex or other ways?

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related