Apigee XML Threat Protection against XML bombs

[chrisyanez]

I am developing an API proxy that takes a XML request payload and sends it through to a backend.
I am working on implementing a XML Threat Protection policy for this proxy but during testing I noticed that it does not protect against XML bomb attacks such as this example listed on https://www.soapui.org/docs/security-testing/security-scans/xml-bomb/

I know one possible solution would be to implement java code in the form of a java callout to handle the protection. Is it possible to handle this using only Apigee policies?

[gonzalezruben · Accepted solution]

Hi!

You should be able to use theXMLThreatProtection policy to protect your backend from XML bombs. In your example, as the entity values get longer the policy will block values longer than 8 kB. If you want to limit the resolved entities values further, then configure more restrictive <ValueLimits> for <Text>.