json-threat-protection.md

description
This page provides the technical details of the JSON Threat Protection policy

JSON Threat Protection

Overview

You can use the json-threat-protection policy to validate a JSON request body by specifying limits for various JSON structures (such as arrays, field names and string values). When an invalid request is detected (meaning the limit is reached), the request will be considered a threat and rejected with a 400 BAD REQUEST.

Functional and implementation information for the json-threat-protection policy is organized into the following sections:

• Examples
• Configuration
• Errors
• Changelogs

Examples

{% hint style="warning" %} This policy can be applied to v2 APIs and v4 HTTP proxy APIs. It cannot be applied to v4 message APIs or v4 TCP proxy APIs. {% endhint %}

{% tabs %} {% tab title="HTTP proxy API example" %} Sample policy configuration:

{
  "name" : "JSON Threat Protection",
  "enabled" : true,
  "policy" : "json-threat-protection",
  "configuration" : {
    "maxDepth" : 90,
    "maxNameLength" : 90,
    "maxValueLength" : 400,
    "maxEntries" : 90,
    "maxArraySize" : 90
  }
}

{% endtab %} {% endtabs %}

Configuration

Phases

The phases checked below are supported by the json-threat-protection policy:

v2 Phases	Compatible?	v4 Phases	Compatible?
onRequest	false	onRequest	false
onResponse	false	onResponse	false
onRequestContent	true	onMessageRequest	false
onResponseContent	false	onMessageResponse	false

Options

The json-threat-protection policy can be configured with the following options:

Property	Required	Description	Type	Default
maxEntries	false	Maximum number of entries allowed for a JSON object. Example: In { "a":{ "b":1, "c":2, "d":3 }}, a has 3 entries	integer (-1 to specify no limit)	100
maxArraySize	false	Maximum number of elements allowed in an array	integer (-1 to specify no limit)	100
maxDepth	false	Maximum depth of JSON structure. Example: { "a":{ "b":{ "c":true }}} has a depth of 3.	integer (-1 to specify no limit)	100
maxNameLength	false	Maximum string length allowed for a JSON property name	integer (-1 to specify no limit)	100
maxValueLength	false	Maximum string length allowed for a JSON property value	integer (-1 to specify no limit)	500

Errors

HTTP status code	Message
400	Invalid JSON structure Maximum depth exceeded Maximum JSON entries exceeded Maximum JSON array size exceeded Maximum JSON field name length exceeded Maximum JSON field value length exceeded

You can override the default response provided by the policy with the response templates feature. These templates must be defined at API level (see the API Console Response Templates option in the API Proxy menu).

The error keys sent by this policy are as follows:

Key	Parameters
JSON_THREAT_DETECTED	-
JSON_THREAT_MAX_DEPTH	-
JSON_THREAT_MAX_ENTRIES	-
JSON_THREAT_MAX_NAME_LENGTH	-
JSON_THREAT_MAX_VALUE_LENGTH	-
JSON_MAX_ARRAY_SIZE	-

Changelogs

{% @github-files/github-code-block url="https://github.com/gravitee-io/gravitee-policy-json-threat-protection/blob/master/CHANGELOG.md" fullWidth="true" %}