​
Code Sanitation Plugin

The code_sanitation plugin provides advanced protection against code injection by analyzing and optionally sanitizing suspicious code patterns across multiple programming languages. It allows you to define whether to block the request or sanitize its content.

​
Technical Overview

The Code Sanitation plugin implements a sophisticated pattern detection and sanitization system. It analyzes incoming requests for potentially malicious code across multiple languages and request parts.

​
Core Components

ComponentFeatures
Language Pattern Engine- Language-specific pattern detection
- Contextual code analysis
- Pattern overlap handling
- Syntax-aware detection
Sanitization System- Pattern replacement
- Context-aware sanitization
- Character encoding handling
- Preservation of code structure
Pattern Registry- Per-language pattern sets
- Pattern priority handling
- Pattern conflict resolution
- Dynamic pattern updates

​
Language-Specific Detection

LanguageCategoryPatterns / Techniques
JavaScriptFunction Executioneval(), Function(), setTimeout() with strings
DOM ManipulationinnerHTML, document.write, script injection
Event Handlerson* attributes, addEventListener with strings
PythonCode Executionexec(), eval(), compile(), __import__()
Shell Commandsos.system, subprocess.Popen, command strings
ShellCommand ExecutionDirect execution, shell metacharacters, substitution
File OperationsRead/write operations, directory manipulation, permission changes

​
Processing Pipeline

PhaseSteps
Content Analysis- Language detection
- Context determination
- Pattern application
- Sanitization planning
Pattern Application- Pattern matching
- Priority enforcement
- Overlap resolution
- Result aggregation
Sanitization Process- Character replacement
- Structure preservation
- Context validation
- Output verification

​
Performance Optimization

AreaTechniques
Pattern Matching- Optimized regex compilation
- Pattern caching
- Early termination
- Partial matching
Content Processing- Streaming and chunked analysis
- Memory efficiency
- CPU optimization
Sanitization- In-place modification
- Buffer reuse
- Minimal allocations
- Efficient replacements

​
Supported Languages

LanguageDescriptionExample Patterns
JavaScriptClient-side scriptingeval(), Function()
PythonServer-side scriptingexec(), eval()
PHPWeb server codeeval(), system()
SQLDatabase queriesUNION SELECT, DROP TABLE
ShellShell commandssystem(), exec()
JavaJVM-based appsRuntime.exec()
C#.NET codeProcess.Start()
RubyRuby scriptseval(), exec()
HTMLMarkup injection<script>, onerror=

​
Configuration

{
  "name": "code_sanitation",
  "enabled": true,
  "stage": "pre_request",
  "settings": {
    "languages": [
      { "language": "javascript", "enabled": true },
      { "language": "python", "enabled": true }
    ],
    "content_to_check": ["headers", "path_and_query", "body"],
    "action": "block",
    "status_code": 400,
    "error_message": "Code injection detected",
    "sanitize_char": "X"
  }
}

​
Configuration Parameters

ParameterTypeDescriptionRequired
languagesarrayList of languages to scanYes
content_to_checkarrayRequest parts to inspect (headers, body, path_and_query)Yes
actionstringblock or sanitizeYes
status_codenumberStatus code returned when blockingNo
error_messagestringMessage returned when blockingNo
sanitize_charstringCharacter used to sanitize contentNo

​
Usage Example

curl -X POST "http://localhost:8080/api/v1/gateways" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Sanitized Gateway",
    "subdomain": "sanitized",
    "required_plugins": [
      {
        "name": "code_sanitation",
        "enabled": true,
        "stage": "pre_request",
        "settings": {
          "languages": [
            { "language": "javascript", "enabled": true }
          ],
          "content_to_check": ["body"],
          "action": "block",
          "status_code": 400
        }
      }
    ]
  }'

​
Behavior Summary

  • Detects and handles code injection patterns across headers, body, and query
  • Supports multiple languages with extensible pattern definitions
  • Blocks or sanitizes input depending on configuration
  • Provides default and custom error messaging
  • Can sanitize in-place or reject malicious requests based on action