CODEWITHSUNDEEP
wso2xsswso2-api-managercode-injectionhtml-injections
m.feyzollahi
m.feyzollahi

Reputation: 301

How to prevent xml and html injection in wso2 apim using regex or other ways?

In WSO2 APIM, We can use regular expression filtering to prevent xss and sql,xml,html injections.

I found that we cannot use "</" and "/>" and even "&lt"semicolon"/" and "/&gt"semicolon"".

<property name="regex" expression="get-property('regex')" value=".*'.*|.*ALTER.*|.*ALTER TABLE.*|.*ALTER VIEW.*|
.*CREATE DATABASE.*|.*CREATE PROCEDURE.*|.*CREATE SCHEMA.*|.*create table.*|.*CREATE VIEW.*|.*DELETE.*|.
*DROP DATABASE.*|.*DROP PROCEDURE.*|.*DROP.*|.*SELECT.*|.*/>.*|.*</.*|.*&#47;&gt;.*|.*&lt;&#47;.*|.*Exception in thread.*|.*#include.*|.*#exec.*|.*#echo.*|.*#config.*|/?(ancestor(-or-self)?|descendant(-or-self)?|following(-sibling))"/>

Probably, the reason is that, All body is casted to xml envelope. I put the link of code in the end.

Do you have any idea to prevent html, script, xml, sql injection in WSO2 apim?

The code of regex filtering is here.

https://github.com/wso2/carbon-apimgt/blob/master/components/apimgt/org.wso2.carbon.apimgt.gateway/src/main/java/org/wso2/carbon/apimgt/gateway/mediators/RegularExpressionProtector.java#L205

Upvotes: 1

Views: 91

Answers (1)

RrR-
RrR-

Reputation: 1430

Whats the APIM version used here? In newer versions of APIM, you can use Operation Policies to achieve this requirement. Please refer threat protectors documentation [1] for more information on this. You can either use inbuilt policies or create a custom policy using a sequence to achieve this requirement.

[1] - https://apim.docs.wso2.com/en/latest/design/api-security/threat-protection/gateway-threat-protectors/gateway-threat-protectors-for-api-manager/

Upvotes: 0

Related Questions