TEC Workbook - IBM

IBM Software
The policy will now protect against malicious SQL injection threats. The file sqlThreat.xml contains a
SOAP message with an SQL Injection Threat in it. The contents of the element contain the
threat:
XI50
DataPower' or '1'='1
{omitted}
Security;Integration;Performance
__6. In the soapUI request window, load the request from c:\labs\requests\sqlThreat.xml.
__7. Click the green submit button to POST the message to ProductServiceProxy. The request
should fail due to “Message contains restricted content (from client)”.
2.6 Transforming with XSL and XPath
At the heart of WebSphere DataPower SOA Appliances is a high speed XSL compiler and execution
engine. In fact, most built-in functionality is engineered using XSL. Some of the built-in stylesheets can
be found in the store directory. XSL developers can easily copy and modify the IBM provided stylesheets
to create new functionality or support emerging standards before IBM makes them available.
When a stylesheet is referenced for the first time, it is compiled using a patented optimizing XSL compiler
for execution on specialized WebSphere DataPower hardware, then cached in memory for high-speed
recall and execution.
IBM has augmented XSL with a rich set of extension functions that enable you to easily add complex
processing functionality to your processing rules. For example, there are extension functions for
performing base-64 encoding and decoding, encryption and decryption, and date/time functions. There
are also functions for communicating with off-box web services as well as LDAP servers.
In this section, you’ll be introduced to how XSL templates are used within processing rules. You’ll also
get a chance to see the decode() extension function for decoding base-64 encoded text.
In the following steps, you’ll add a transform action to the response (server to client) rule instead of the
request rule. Since the transform action will modify the overall structure of the message, it won’t match
the schema that the backend service is expecting, therefore the request will fail. To avoid this, you’ll
modify the response which is destined back to soapUI.
__1. In the policy editor, towards the bottom, click on the Server to Client rule to make it the active
rule in the editor.
Page 46 WebSphere Lab Jam