---
schema_version: "1"
id: a65a1b31c6758d233d9dfea2f6ce2f15fba56f128ff69b8b40b17254306b0bf4
title: XML Threat Protection Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-xml-threat-protection.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-xml-threat-protection
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 2d447a4a7383dd047294cc4a4426f66174ff9614107c9571aceb79a524f84516
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: xml threat protection, api gateway, flex gateway, gateway, policy
---

# XML Threat Protection Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>XML Threat Protection</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Protects against malicious XML in API requests</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.10.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/xml-threat-protection-release-notes">XML Threat Protection Policy</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>400 - Bad Request</p></td></tr></tbody></table>

## Summary

Applications that process XML requests are susceptible to attacks characterized by unusual inflation
of elements, attributes, and deep nesting levels. Attackers use recursive techniques to consume
memory resources. Dramatic increases in the size of the application data often signal a security
risk. Use the XML Threat Protection policy to reject unusual requests that exceed the defined
expected size.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: xml-threat-protection-flex config: maxNodeDepth: <number> // OPTIONAL, default:
-1 maxAttributeCountPerElement: <number> // OPTIONAL, default: -1 maxChildCount: <number> //
OPTIONAL, default: -1 maxTextLength: <number> // OPTIONAL, default: -1 maxAttributeLength: <number>
// OPTIONAL, default: -1 maxCommentLength: <number> // OPTIONAL, default: -1

> [!NOTE] Defining a parameter as `-1` means the parameter has no limit.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>maxNodeDepth</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum node depth of an XML document.</p></div></div></td></tr><tr><td><div><div><p><code>maxAttributeCountPerElement</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum number of attributes in an element. Attributes used for defining namespaces are not counted.</p></div></div></td></tr><tr><td><div><div><p><code>maxChildCount</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum number of children of an element in the XML document.</p></div></div></td></tr><tr><td><div><div><p><code>maxTextLength</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum length in characters of text nodes in the XML document.</p></div></div></td></tr><tr><td><div><div><p><code>maxAttributeLength</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum length in characters of an attribute in the XML document.</p></div></div></td></tr><tr><td><div><div><p><code>maxCommentLength</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum number of comment characters in the XML document.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: xml-threat-protection-flex config: maxNodeDepth: 1 maxAttributeCountPerElement:
1 maxChildCount: 2 maxTextLength: 20 maxAttributeLength: 20 maxCommentLength: 20

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Maximum Node Depth</p></div></div></td><td><div><div><p>Specifies the maximum node depth of an XML document.</p></div></div></td></tr><tr><td><div><div><p>Maximum Attribute Count Per Element</p></div></div></td><td><div><div><p>Specifies the maximum number of attributes in an element. Attributes used for defining namespaces are not counted.</p></div></div></td></tr><tr><td><div><div><p>Maximum Child Count</p></div></div></td><td><div><div><p>Specifies the maximum number of children of an element in the XML document.</p></div></div></td></tr><tr><td><div><div><p>Maximum Text Length</p></div></div></td><td><div><div><p>Specifies the maximum length in characters of text nodes in the XML document.</p></div></div></td></tr><tr><td><div><div><p>Maximum Attribute Length</p></div></div></td><td><div><div><p>Specifies the maximum length in characters of an attribute in the XML document.</p></div></div></td></tr><tr><td><div><div><p>Maximum Comment Length</p></div></div></td><td><div><div><p>Specifies the maximum number of comment characters in the XML document.</p></div></div></td></tr></tbody></table>