search

stephaneey / azure-apim-extension

Full Azure API Management suite and more VSTS extension
MIT License
66 stars 48 forks source link

"API Management - Create or Update API" don't escape all characters used in policy for JSON #89

Open Iapmes opened 4 years ago

Iapmes commented 4 years ago

While working on policies involving more complex characters in policy expressions used in e..g regular expressions (like backslashes) found that these are not JSON escaped.

E.g. for https://docs.microsoft.com/en-us/azure/api-management/api-management-policy-expressions

The following example regular expression contains a backslash: @(Regex.Match(context.Response.Headers.GetValueOrDefault("Cache-Control",""), @"max-age=(?<maxAge>\d+)").Groups["maxAge"]?.Value) This if used needs to be escaped with a backslash (\\).

The current v3 does only seem to escape double quotes:

https://github.com/stephaneey/azure-apim-extension/blob/98a1979e70420c32d9720111865aa168c6c64481/apim/v3/apim.ps1#L85-L88

In addition it's worth pointing out that special characters also needs XML escaping. (e.g. " -> " etc.)

iekumdario commented 2 years ago

I'm facing this same issue, and would get 400 errors for policy expressions using .Contains("somestring"). Tried working around it by changing the api version to the one used in the azure portal and the request went through, but since the payload is different and you now have to specify the format being used, it would end up xml-escaped in the apim portal.