XML Threat Protection Policy

Policy Name

XML Threat Protection

Summary

Protects against malicious XML in API requests

Category

Security

First Omni Gateway version available

v1.10.0

Release Notes

XML Threat Protection Policy

Returned Status Codes

400 - Bad Request

Summary

Applications that process XML requests are susceptible to attacks characterized by unusual inflation of elements, attributes, and deep nesting levels. Attackers use recursive techniques to consume memory resources. Dramatic increases in the size of the application data often signal a security risk. Use the XML Threat Protection policy to reject unusual requests that exceed the defined expected size.

Configuring Policy Parameters

Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy definition and table of parameters:

- policyRef:
    name: xml-threat-protection-flex
  config:
    maxNodeDepth: <number> // OPTIONAL, default: -1
    maxAttributeCountPerElement: <number> // OPTIONAL, default: -1
    maxChildCount: <number> // OPTIONAL, default: -1
    maxTextLength: <number> // OPTIONAL, default: -1
    maxAttributeLength: <number> // OPTIONAL, default: -1
    maxCommentLength: <number> // OPTIONAL, default: -1

Defining a parameter as -1 means the parameter has no limit.

Parameter Required Default Value Description

Parameter	Required	Default Value	Description
`maxNodeDepth`	No	-1	Specifies the maximum node depth of an XML document.
`maxAttributeCountPerElement`	No	-1	Specifies the maximum number of attributes in an element. Attributes used for defining namespaces are not counted.
`maxChildCount`	No	-1	Specifies the maximum number of children of an element in the XML document.
`maxTextLength`	No	-1	Specifies the maximum length in characters of text nodes in the XML document.
`maxAttributeLength`	No	-1	Specifies the maximum length in characters of an attribute in the XML document.
`maxCommentLength`	No	-1	Specifies the maximum number of comment characters in the XML document.

maxNodeDepth

-1

Specifies the maximum node depth of an XML document.

maxAttributeCountPerElement

-1

Specifies the maximum number of attributes in an element. Attributes used for defining namespaces are not counted.

maxChildCount

-1

Specifies the maximum number of children of an element in the XML document.

maxTextLength

-1

Specifies the maximum length in characters of text nodes in the XML document.

maxAttributeLength

-1

Specifies the maximum length in characters of an attribute in the XML document.

maxCommentLength

-1

Specifies the maximum number of comment characters in the XML document.

Resource Configuration Example

- policyRef:
    name: xml-threat-protection-flex
  config:
    maxNodeDepth: 1
    maxAttributeCountPerElement: 1
    maxChildCount: 2
    maxTextLength: 20
    maxAttributeLength: 20
    maxCommentLength: 20

Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

Field	Description
Maximum Node Depth	Specifies the maximum node depth of an XML document.
Maximum Attribute Count Per Element	Specifies the maximum number of attributes in an element. Attributes used for defining namespaces are not counted.
Maximum Child Count	Specifies the maximum number of children of an element in the XML document.
Maximum Text Length	Specifies the maximum length in characters of text nodes in the XML document.
Maximum Attribute Length	Specifies the maximum length in characters of an attribute in the XML document.
Maximum Comment Length	Specifies the maximum number of comment characters in the XML document.

Field

Description

Maximum Node Depth

Specifies the maximum node depth of an XML document.

Maximum Attribute Count Per Element

Specifies the maximum number of attributes in an element. Attributes used for defining namespaces are not counted.

Maximum Child Count

Specifies the maximum number of children of an element in the XML document.

Maximum Text Length

Specifies the maximum length in characters of text nodes in the XML document.

Maximum Attribute Length

Specifies the maximum length in characters of an attribute in the XML document.

Maximum Comment Length

Specifies the maximum number of comment characters in the XML document.