Json threat protection throwing 'Not a number' for KVM variables

[#1]

Hi,

When i try to give variable names as below, i am getting "Schema validation failed. Cause: Not a number".

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<JSONThreatProtection async="false" continueOnError="false" enabled="true" name="JSON-Threat-Protection-1">
    <DisplayName>JSON Threat Protection-1</DisplayName>
    <Properties/>
    <ArrayElementCount>{Json_ArrayElementCount}</ArrayElementCount>
    <ContainerDepth>{Json_ContainerDepth}</ContainerDepth>
    <ObjectEntryCount>{Json_ObjectEntryCount}</ObjectEntryCount>
    <ObjectEntryNameLength>{Json_ObjectEntryNameLength}</ObjectEntryNameLength>
    <Source>request</Source>
    <StringValueLength>{Json_StringValueLength}</StringValueLength>
</JSONThreatProtection>

[dchiesa1]

Yes, according to my reading of the documentation for the JSONThreatProtection policy, the values inside those elements are not "message templates", which means you need to specify an actual number, not a reference to a variable like {my_variable_name_here}.

The behavior you're seeing is expected.

[zeggarin]

hello dchiesa1

what will happen if I will pass a negative integer like :

<ArrayElementCount>-1</ArrayElementCount>
    <ContainerDepth>-1</ContainerDepth>

thanks

[dchiesa1]

It disables the relevant check. (We should document this). 

[ahibbert]

Hi @Dino-at-Google

It would be really useful if this was a feature though, either by using a ref or template element to set these values. We have some shared flows where we intend to use these policies with different values for different consumers. Is this possible by any current means?

Can we raise a feature request?

[shawkyfoda]

@dchiesa1  Highly useful requirement to have a dynamic variables to configure your "json thread protection" policy 

[apickelsimer]

We are currently tracking this feature request internally (ref: b/149943055). I will update this post if the FR is prioritized and delivered.