description |
---|
This page provides the technical details of the Regex Threat Protection policy |
{% hint style="warning" %} This feature requires Gravitee's Enterprise Edition. {% endhint %}
You can use the regex-threat-protection
policy to extract information from a request (headers, path, query parameters, body payload) and evaluate that content against pre-defined regular expressions. If any content matches the specified regular expression, the request is considered a threat and rejected with a 400 BAD REQUEST. The policy injects processing report messages into request metrics for analytics.
Functional and implementation information for the regex-threat-protection
policy is organized into the following sections:
{% hint style="warning" %} This policy can be applied to v2 APIs and v4 proxy APIs. It cannot be applied to v4 message APIs. {% endhint %}
{% tabs %} {% tab title="Proxy API example" %} Sample policy configuration for SQL Injection regex detection:
{
"name" : "Regex Threat Protection",
"enabled" : true,
"policy" : "regex-threat-protection",
"configuration" : {
"regex" : ".*[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update)|(\\bor\\b)).*",
"checkPath" : true,
"checkBody" : true,
"caseSensitive" : false,
"checkHeaders" : true
}
}
{% endtab %} {% endtabs %}
The phases checked below are supported by the regex-threat-protection
policy:
v2 Phases | Compatible? | v4 Phases | Compatible? |
---|---|---|---|
onRequest | true | onRequest | true |
onResponse | false | onResponse | false |
onRequestContent | true | onMessageRequest | false |
onResponseContent | false | onMessageResponse | false |
The regex-threat-protection
policy can be configured with the following options:
Property | Required | Description | Type | Default |
---|---|---|---|---|
regex | true | Regex used to detect malicious injections. You can enable this regular expression on headers, path and body or add multiple Regex threat protection policies with different regex, depending on your needs. | string | |
caseSensitive | false | Perform case-sensitive matching. WARNING: Use with caution. Enabling case sensitive matching may miss some risky patterns such as DrOp TaBlE . | boolean | false |
checkHeaders | false | Evaluate regex on request headers | boolean | true |
checkPath | false | Evaluate regex on request path and query parameters | boolean | true |
checkBody | false | Evaluate regex on request body content | boolean | true |
The following is the compatibility matrix for APIM and the regex-threat-protection
policy:
Plugin Version | Supported APIM versions |
---|---|
1.x | All |
HTTP status code | Message |
---|---|
400 | Applies to:
|
You can use the response template feature to override the default response provided by the policy. These templates must be defined at the API level (see the API Console Response Templates option in the API Proxy menu).
The error keys sent by this policy are as follows:
Key | Parameters |
---|---|
HEADER_THREAT_DETECTED | - |
PATH_THREAT_DETECTED | - |
BODY_THREAT_DETECTED | - |
{% @github-files/github-code-block url="https://github.com/gravitee-io/gravitee-policy-regex-threat-protection/blob/master/CHANGELOG.md" %}