Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.
#Automation
Supported Versions: 9.12 & above
SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL code for back-end database manipulation to access information that was not intended to be displayed. This information may include any number of items, including sensitive company data, user lists or private customer details. The impact SQL injection can have on a business is far reaching. A successful attack may result in the unauthorised viewing of user lists, the deletion of entire tables and, in certain cases, the attacker gaining administrative rights to a database, all of which are highly detrimental to a business. API GATEWAY provides two types of filters that you can enable to prevent SQL injection attacks:
For example, in the HTTP query string, http://localhost:1111/invoke/myjdbc.db:addUser?name=' or '1'='1' the parameter is name.
The Query param userid contains an invalid special character ' eventually DB-Specific-SQL-Injection-filter blocks the request.
For example, in the following XML payload, the Text elements (Name, Designation, and Country) contain invalid characters ', #, and -- respectively.
<
Employee
><
ID
>1245</
>
NAME
>Albu'm name</
DESIGNATION
>SS#E</
COUNTRY
>USA--</
DOJ
>2014</
</
The below XML payload consists of invalid characters like –- in <DOJ> attribute so that SQL Injection filter gets violated and denies the request .
Hi @Mihai_Ungureanu5 It will enable to safe gaurd your system/API from SQL injection attacks.
Example: In this example , I would like to validate my request against fields called as [ addUser ] , So I would need to specify the same in parameter . if nothings specified gateway will validate against all the parameters.
Parameters are applicable only for HTTP queries and HTTP form data, in which there are name value pairs.
For example, in the HTTP query string, http://localhost:1111/invoke/myjdbc.db:addUser?userid=’ or ‘1’=‘1’ --, the parameter is userid.
I hope this clarifies your concern
No, I mean for the “Standard SQL Injection Protection”
So, what exactly are the expressions to be put in the textbox there?
@Mihai_Ungureanu5 The Custom filters to invoke a service that is available on API Gateway to support custom authentication, logging/ auditing in the DMZ. Is that are you looking for ?
There is now a possibility to add custom filters. What is the syntax and how to recover examples for it?