---
schema_version: "1"
id: 6fb9b3536ae80351d4fc3481896e00a408b1168213160b3a785a29768395c0b9
title: XML Threat Protection Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-gateway/policies-included-xml-threat-protection.md
canonical_url: https://docs.mulesoft.com/mule-gateway/policies-included-xml-threat-protection
source_site: docs.mulesoft.com
content_type: documentation
content_hash: bc54eac556e3e3dc7fd36769f0b8d3765080d8d6722d1e23fcba5d167c591ede
description: MuleSoft Documentation Site
latest: true
---
---
product: Mule Gateway
keywords: xml threat protection, api gateway, flex gateway, gateway, policy
---

# XML Threat Protection Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>XML Threat Protection</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Protects against malicious XML in API requests</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Mule version available</strong></p></td><td><p>v3.8.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>400 - Bad Request</p></td></tr></tbody></table>

## Summary

Applications processing XML requests are susceptible to attacks characterized by unusual inflation
of elements, attributes, and nesting levels. Attackers use recursive techniques to consume memory
resources. Dramatic increases in the size of the application data often signal a security problem.
The XML Threat Protection policy helps protect your applications from such intrusions.

If you find that attacks on your Anypoint Platform setup are difficult to detect, design your
services architecture with layers of protection in addition to XML Threat Protection.

## Configuring Policy Parameters

### Mule Gateway

When you apply the XML Threat Protection policy to your API from the UI, the following parameters
are displayed:

<table><colgroup><col> <col> <col> <col></colgroup><tbody><tr><td><p><strong>Field</strong></p></td><td><p><strong>Description</strong></p></td><td><p><strong>Default</strong></p></td><td><p><strong>Required</strong></p></td></tr><tr><td><p>Maximum Node Depth</p></td><td><p>Specifies the maximum node depth of an XML document.</p></td><td><p>-1</p></td><td><p>false</p></td></tr><tr><td><p>Maximum Attribute Count Per Element</p></td><td><p>Specifies the maximum number of attributes in an element. Note that attributes used for defining namespaces are not counted.</p></td><td><p>-1</p></td><td><p>false</p></td></tr><tr><td><p>Maximum Child Count</p></td><td><p>Specifies the maximum number of children of an element in the XML document.</p></td><td><p>-1</p></td><td><p>false</p></td></tr><tr><td><p>Maximum Text Length</p></td><td><p>Specifies the maximum length (in characters) of text nodes in the XML document.</p></td><td><p>-1</p></td><td><p>false</p></td></tr><tr><td><p>Maximum Attribute Length</p></td><td><p>Specifies the maximum length (in characters) of an attribute in the XML document.</p></td><td><p>-1</p></td><td><p>false</p></td></tr><tr><td><p>Maximum Comment Length</p></td><td><p>Specifies the maximum number of comment characters in the XML document.</p></td><td><p>-1</p></td><td><p>false</p></td></tr></tbody></table>

> [!NOTE] A value of -1 indicates that the field value has no limits.

## Example

The following screenshot shows an example of the parameters configured for the XML Threat Protection
policy:

![xml threat policy](/mulesoft/current/en-us/mule-gateway/_images/xml-threat-policy.png)