regex-threat-protection.md

description
This page provides the technical details of the Regex Threat Protection policy

Regex Threat Protection

{% hint style="warning" %} This feature requires Gravitee's Enterprise Edition. {% endhint %}

Overview

You can use the regex-threat-protection policy to extract information from a request (headers, path, query parameters, body payload) and evaluate that content against pre-defined regular expressions. If any content matches the specified regular expression, the request is considered a threat and rejected with a 400 BAD REQUEST. The policy injects processing report messages into request metrics for analytics.

Functional and implementation information for the regex-threat-protection policy is organized into the following sections:

• Examples
• Configuration
• Compatibility Matrix
• Errors
• Changelogs

Examples

{% hint style="warning" %} This policy can be applied to v2 APIs and v4 HTTP proxy APIs. It cannot be applied to v4 message APIs or v4 TCP proxy APIs. {% endhint %}

{% tabs %} {% tab title="HTTP proxy API example" %} Sample policy configuration for SQL Injection regex detection:

{
        "name" : "Regex Threat Protection",
        "enabled" : true,
        "policy" : "regex-threat-protection",
        "configuration" : {
          "regex" : ".*[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update)|(\\bor\\b)).*",
          "checkPath" : true,
          "checkBody" : true,
          "caseSensitive" : false,
          "checkHeaders" : true
        }
}

{% endtab %} {% endtabs %}

Configuration

Phases

The phases checked below are supported by the regex-threat-protection policy:

v2 Phases	Compatible?	v4 Phases	Compatible?
onRequest	true	onRequest	true
onResponse	false	onResponse	false
onRequestContent	true	onMessageRequest	false
onResponseContent	false	onMessageResponse	false

Options

The regex-threat-protection policy can be configured with the following options:

Property	Required	Description	Type	Default
regex	true	Regex used to detect malicious injections. You can enable this regular expression on headers, path and body or add multiple Regex threat protection policies with different regex, depending on your needs.	string
caseSensitive	false	Perform case-sensitive matching. WARNING: Use with caution. Enabling case sensitive matching may miss some risky patterns such as DrOp TaBlE.	boolean	false
checkHeaders	false	Evaluate regex on request headers	boolean	true
checkPath	false	Evaluate regex on request path and query parameters	boolean	true
checkBody	false	Evaluate regex on request body content	boolean	true

Compatibility matrix

The following is the compatibility matrix for APIM and the regex-threat-protection policy:

Plugin Version	Supported APIM versions
1.x	All

Errors

HTTP status code	Message
400	Applies to: Matching request headers Matching request path or query parameters Matching request body

You can use the response template feature to override the default response provided by the policy. These templates must be defined at the API level (see the API Console Response Templates option in the API Proxy menu).

The error keys sent by this policy are as follows:

Key	Parameters
HEADER_THREAT_DETECTED	-
PATH_THREAT_DETECTED	-
BODY_THREAT_DETECTED	-

Changelogs

{% @github-files/github-code-block url="https://github.com/gravitee-io/gravitee-policy-regex-threat-protection/blob/master/CHANGELOG.md" %}