Cross Site Scripting(XSS) and SQL Injection Policy Setup

[#1]

How to handle Cross Site Scripting(XSS) and SQL Injection in API proxy level ? Is there custom policies exists to handle these 2 vulnerabilites ?

[gnanasekaran · Accepted solution]

Yes, you can - there are already several articles on this topic, check it out

• API Vulnerabilities and their mitigation in Apigee Edge
• Regular Expression Protection
• How to protect your Micro-services
• Protecting Against SQL Injection

[DChiesa]

Nice answer!

[#4]

@Mukundha Madhavan , Thank You !! I got answer how to handle for SQL Injection.

I believe little detail about policy for Cross Site Scripting(XSS). I see a thread for API Vulnerablities. But, would be great if have more details for XSS from Policy Perspective. Thank You for your help !!

[gnanasekaran]

Similar to the SQL injection -- from an API perspective, it is important to sanitize the input parameters. Look here for - detecting script patterns in the policy, specifically the javascript injection. As mentioned in the other articles, there are several solutions to handle at different parts of the stack

[#6]

Thanks @Mukundha Madhavan.

I see this Java Script Pattern : <\s*script\b[^>]*>[^<]+<\s*/\s*script\s*> here. But how i use in <Pattern> tag in "Regular Expression Protection" Policy. Am I referring Right Policy ? if use either <\s*script\b[^>]*>[^<]+<\s*/\s*script\s*> or <\s*script\b[^>]*>[^<]+<\s*/\s*script\s*> Pattern tag does not accept this java script pattern. Can you guide on this ?

[ahemanna]

Thank you for this, the fourth link appears to be broken.. any chance you got the updated link?

I do understand it has been more than 2 years, just checking 🙂