Best Practice for Cross Site Scripting(XSS)

[#1]

Any Best Practice Steps or policies for Cross Site Scripting(XSS) Vulnerabilites ?

I read an article in community. But, do not mention how to achieve in Edge with samples. Can you help me how to achieve in Edge with sample ?

• API Vulnerabilities and their mitigation in Apigee Edge

I read another document here saying "Examples of blacklist patterns" where Java Script Injection have pattern <\s*script\b[^>]*>[^<]+<\s*/\s*script\s*>. But, which policy will accept this ?

Thank You.

[#2]

You can use Regular Expression Protection Policy. http://docs.apigee.com/api-services/reference/regular-expression-protection

If any specified regular expressions evaluate to true, the message is considered a threat and is rejected.

[#3]

I used Regular Expression Protection Policy for Cross Site Scripting(XSS) where I used a pattern say Example :

Same can be applicable for Header, Query, JSON/XML Payload & URIPath. But, only CONS of using this policy is, have to map each parameter by parameter. So, need to edit this policy for every Proxy based on the parameter used on that proxy. That is biggest drawback on this policy to use for XSS which I see..

 <QueryParam name="myQuery">
        <Pattern>[tT]rue</Pattern>
        <Pattern>.*true.*</Pattern>        
        <Pattern ignoreCase="true"><\s*script\b[^>]*>[^<]+<\s*\/\s*script\s*></Pattern>
  </QueryParam>

[sunandita_dam]

@Kumaresan Sithambaram Looks to me valid concern. @Anil Sagar , @Dino : Is there workaround of this issue?

[DChiesa]

yes, I think if you wanted to apply a filter on all parameters, you'd need to script it with Javascript using the RegExp object. I think it's a valid request, to ask that the policy be expanded to handle all query params.

[#6]

@Dino Could you please elaborate about "filter on all parameters" ? and How do we achieve to read all query, header params using JS with Equivalent functionality of Reg. Exp. Policy ?

[DChiesa]

I mean, if you want to apply a regex test to all parameters, you would need to use Javascript to loop through them.

I suppose you would do something like this:

var queryParamNames = context.getVariable("request.queryparams.names");
var a = queryParamNames.toArray();
var re = new RegExp('<\\s*script\\b[^>]*>[^<]+<\\s*\\/\\s*script\\s*>');
var isFault = null;
a.forEach(function(name) {
  if ( ! isFault) {
    var value = context.getVariable("request.queryparam." + name);
    if (re.test(value)) { isFault = name; }
  }
});


if (isFault) {
  context.setVariable('verify_qparams_failed', true);
  context.setVariable('verify_qparams_name', isFault);
  throw new Error("queryparam "+ isFault + " rejected as unsafe.");
}
else {
  context.setVariable('verify_qparams_failed', false);
}