<?xml version="1.0" encoding="UTF-8"?>
<exp:Export Version="3.0"
    xmlns:L7p="http://www.layer7tech.com/ws/policy"
    xmlns:exp="http://www.layer7tech.com/ws/policy/export" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy">
    <exp:References/>
    <wsp:Policy xmlns:L7p="http://www.layer7tech.com/ws/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy">
        <wsp:All wsp:Usage="Required">
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="/**********************************************"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue=" "/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue=" WARNING - May Generate False Positives"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue=" "/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="Use this policy to filter out incoming requests that could"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="be an attempt at exploiting a back-end log4shell vulnerability by"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="looking for instances of &quot;${&quot; in the headers, parameters and payload"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue=" "/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="Prior to including this policy in a service (or globally), you should"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="validate that legitimate API traffic will not trigger this (false"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="positives). You should also test for performance impacts for APIs"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="that have high traffic, large payloads, or require low-latency."/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue=" "/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="If the pattern is detected, this policy fails, otherwise it suceeds."/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="The failure is not a garantee of a log4shell exploit."/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue=" "/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="Provided as an example only. For a more detailed explanation on"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="how this could help with log4shell and how this is not a silver"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="bullet, please read this article:"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="https://apiacademy.co/2021/12/can-you-pattern-detect-your-way-out-of-the-log4j-exploit-risk/"/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue=" "/>
            </L7p:CommentAssertion>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="**********************************************/"/>
            </L7p:CommentAssertion>
            <wsp:OneOrMore wsp:Usage="Required">
                <wsp:All wsp:Usage="Required">
                    <L7p:ComparisonAssertion>
                        <L7p:CaseSensitive booleanValue="false"/>
                        <L7p:Expression1 stringValue="${request.url.query}"/>
                        <L7p:Operator operatorNull="null"/>
                        <L7p:Predicates predicates="included">
                            <L7p:item stringLength="included">
                                <L7p:Max intValue="-1"/>
                                <L7p:Min intValue="1"/>
                            </L7p:item>
                        </L7p:Predicates>
                    </L7p:ComparisonAssertion>
                    <L7p:EncodeDecode>
                        <L7p:SourceVariableName stringValue="request.url.query"/>
                        <L7p:TargetDataType variableDataType="string"/>
                        <L7p:TargetVariableName stringValue="decodedquery"/>
                        <L7p:TransformType transformType="URL_DECODE"/>
                    </L7p:EncodeDecode>
                </wsp:All>
                <L7p:SetVariable>
                    <L7p:Base64Expression stringValue=""/>
                    <L7p:VariableToSet stringValue="decodedquery"/>
                </L7p:SetVariable>
                <L7p:assertionComment>
                    <L7p:Properties mapValue="included">
                        <L7p:entry>
                            <L7p:key stringValue="LEFT.COMMENT"/>
                            <L7p:value stringValue="decode query if present"/>
                        </L7p:entry>
                    </L7p:Properties>
                </L7p:assertionComment>
            </wsp:OneOrMore>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="Here you can adjust what gets scanned by the regex"/>
            </L7p:CommentAssertion>
            <L7p:SetVariable>
                <L7p:AssertionComment assertionComment="included">
                    <L7p:Properties mapValue="included">
                        <L7p:entry>
                            <L7p:key stringValue="LEFT.COMMENT"/>
                            <L7p:value stringValue="stage inspection input"/>
                        </L7p:entry>
                    </L7p:Properties>
                </L7p:AssertionComment>
                <L7p:Base64Expression stringValue="JHtkZWNvZGVkcXVlcnl9JHtyZXF1ZXN0Lmh0dHAuYWxsaGVhZGVydmFsdWVzfSR7cmVxdWVzdC5tYWlucGFydH0NCg0K"/>
                <L7p:VariableToSet stringValue="toeval"/>
            </L7p:SetVariable>
            <L7p:CommentAssertion>
                <L7p:Comment stringValue="Here you can adjust the pattern you want to scan for"/>
            </L7p:CommentAssertion>
            <L7p:Regex>
                <L7p:AutoTarget booleanValue="false"/>
                <L7p:OtherTargetMessageVariable stringValue="toeval"/>
                <L7p:ProceedIfPatternMatches booleanValue="false"/>
                <L7p:Regex stringValue="\$\{"/>
                <L7p:RegexName stringValue="Fail if ${"/>
                <L7p:Replacement stringValue=""/>
                <L7p:Target target="OTHER"/>
            </L7p:Regex>
        </wsp:All>
    </wsp:Policy>
</exp:Export>
