Panther medium experimental python

AWS WAF Has XSS Predicate

This policy validates that all WAF's have at least one rule with a predicate matching on and blocking XSS attacks.

View Source

Detection Logic

from panther_base_helpers import deep_get


def policy(resource):

    for rule in resource["Rules"] or []:
        # Must block the XSS
        if deep_get(rule, "Action", "Type") != "BLOCK":
            continue

        # Only passes if there is an XSS matching predicate
        for predicate in rule["Predicates"]:
            if predicate["Type"] == "XssMatch":
                return True

    return False

Field Validations

Loading…

Comments (0)

Loading comments...