SQL Threat Detector

Use the SQL Threat Detector policy to protect APIs against SQL commands injected in the header, path, query, and payload of incoming HTTP requests. You can use this policy to detect embedded commands like CREATE TABLE and DROP TABLE that could be injected into an HTTP request, and as a result trigger the creation, deletion, or denial of service of backend databases. As the policy owner, you can thwart these SQL injection threats by specifying regular expressions (regex) to identify SQL commands, elements, strings, and non-database conformant characters from being passed in the payload.

If an SQL expression or command is provided in the request payload JSON, query string, header, or path, then the API consumer receives a Validation failed error. If the API request is safe, then the API can successfully be executed.

The default expression contains common SQL commands that could pose injection threats. You can modify it or use a custom regex. The default regex does not have to be modified for the policy to function. Since the regex can contain many values, you can add multiple entries to separate their expressions into manageable portions for readability and organization considerations. You can also append additional expressions to the default regex.

Policy Execution Order

This SQL Validator policy executes after the request has been authenticated.

Expression Enabled Fields in API Policies

All expression enabled fields take expressions from the SnapLogic Expression Language and the API Policy Manager functions.

Parameter Name	Description	Default Value	Example

Parameter Name	Description	Default Value	Example
Label	Required. The name for the API policy.	SQL Threat Detector
When this policy should be applied	An expression enabled field that determines the condition to be fulfilled for the API policy to execute. For example, if the value in this field is request.method == "POST", the API policy is executed only if the request method is a POST.	True	request.method == "POST"
Threat Detection Regex	The SQL string that detects threats. You can enter multiple strings.	`.'.\|.ALTER.\|.ALTER TABLE.\|.ALTER VIEW.\|.CREATE DATABASE.\|.CREATE PROCEDURE.\|.CREATE SCHEMA.\|.CREATE TABLE.\|.CREATE VIEW.\|.DELETE.\|.DROP DATABASE.\|.DROP PROCEDURE.\|.DROP.\|.SELECT.`	`.'.\|.ALTER.\|.ALTER TABLE.\|.ALTER VIEW.\|.CREATE DATABASE.\|.*CREATE PROCEDURE 1 and 1 [^A-Za-z0-9\s]+`
Status	Indicates whether the API policy is enabled or disabled.	Enabled	Disabled