use of org.wso2.carbon.apimgt.ballerina.threatprotection.analyzer.XMLAnalyzer in project carbon-apimgt by wso2.
the class AnalyzerHolder method getAnalyzer.
/**
* Borrows an object from pools (xml or json) for threat analysis
*
* @param contentType Content-Type of the payload
* @param policyId ID of the API
* @return Instance of APIMThreatAnalyzer based on content type
*/
public static APIMThreatAnalyzer getAnalyzer(String contentType, String policyId) {
APIMThreatAnalyzer analyzer = null;
if (T_TEXT_XML.equalsIgnoreCase(contentType) || T_APPLICATION_XML.equalsIgnoreCase(contentType)) {
try {
analyzer = xmlAnalyzerAnalyzerPool.borrowObject();
// configure per api
XMLConfig xmlConfig = ConfigurationHolder.getXmlConfig(policyId);
if (xmlConfig == null) {
xmlConfig = ConfigurationHolder.getXmlConfig("GLOBAL-XML");
}
if (xmlConfig == null) {
return null;
}
analyzer.configure(xmlConfig);
} catch (Exception e) {
logger.error("Threat Protection: Failed to create XMLAnalyzer, " + e.getMessage());
}
} else if (T_TEXT_JSON.equalsIgnoreCase(contentType) || T_APPLICATION_JSON.equalsIgnoreCase(contentType)) {
try {
analyzer = jsonAnalyzerAnalyzerPool.borrowObject();
// configure per api
JSONConfig jsonConfig = ConfigurationHolder.getJsonConfig(policyId);
if (jsonConfig == null) {
jsonConfig = ConfigurationHolder.getJsonConfig("GLOBAL-JSON");
}
if (jsonConfig == null) {
return null;
}
analyzer.configure(jsonConfig);
} catch (Exception e) {
logger.error("Threat Protection: Failed to create JSONAnalyzer, " + e.getMessage());
}
}
return analyzer;
}
use of org.wso2.carbon.apimgt.ballerina.threatprotection.analyzer.XMLAnalyzer in project carbon-apimgt by wso2.
the class XMLAnalyzerTestCase method testConfigureAnalyzerException.
@Test(expectedExceptions = UnsupportedOperationException.class)
public void testConfigureAnalyzerException() throws Exception {
XMLAnalyzer analyzer = new XMLAnalyzer();
JSONConfig config = new JSONConfig();
analyzer.configure(config);
}
use of org.wso2.carbon.apimgt.ballerina.threatprotection.analyzer.XMLAnalyzer in project carbon-apimgt by wso2.
the class XMLAnalyzerTestCase method testMaxAttributeCount.
@Test(expectedExceptions = APIMThreatAnalyzerException.class)
public void testMaxAttributeCount() throws Exception {
init();
String xmlString = "<a><root aaaaaaaaaa='aaaaaaa' b='b' c='c' d='d' e='e' f='f' g='g'></root></a>";
XMLAnalyzer analyzer = new XMLAnalyzer();
analyzer.configure(xmlConfig);
analyzer.analyze(xmlString, "/foo");
}
use of org.wso2.carbon.apimgt.ballerina.threatprotection.analyzer.XMLAnalyzer in project carbon-apimgt by wso2.
the class XMLAnalyzerTestCase method testMaxEntityExpansionLimit.
@Test(expectedExceptions = APIMThreatAnalyzerException.class)
public void testMaxEntityExpansionLimit() throws Exception {
init();
XMLAnalyzer analyzer = new XMLAnalyzer();
xmlConfig.setEntityExpansionLimit(100);
xmlConfig.setDtdEnabled(true);
analyzer.configure(xmlConfig);
String xmlString = "<?xml version=\"1.0\"?>\n" + "<!DOCTYPE lolz [\n" + " <!ENTITY lol \"lol\">\n" + " <!ELEMENT lolz (#PCDATA)>\n" + " <!ENTITY lol1 \"&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;\">\n" + " <!ENTITY lol2 \"&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;\">\n" + " <!ENTITY lol3 \"&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;\">\n" + " <!ENTITY lol4 \"&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;\">\n" + " <!ENTITY lol5 \"&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;\">\n" + " <!ENTITY lol6 \"&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;\">\n" + " <!ENTITY lol7 \"&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;\">\n" + " <!ENTITY lol8 \"&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;\">\n" + " <!ENTITY lol9 \"&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;\">\n" + "]>\n" + "<lolz>&lol9;</lolz>";
analyzer.analyze(xmlString, "/foo");
}
use of org.wso2.carbon.apimgt.ballerina.threatprotection.analyzer.XMLAnalyzer in project carbon-apimgt by wso2.
the class XMLAnalyzerTestCase method testMaxAttributeLength.
@Test(expectedExceptions = APIMThreatAnalyzerException.class)
public void testMaxAttributeLength() throws Exception {
init();
String xmlString = "<root attribute1111111111='someValue111111111' attribute2='1'></root>";
XMLAnalyzer analyzer = new XMLAnalyzer();
xmlConfig.setMaxAttributeLength(1);
xmlConfig.setMaxAttributeCount(1);
analyzer.configure(xmlConfig);
analyzer.analyze(xmlString, "/foo");
}
Aggregations