Hi there,
According to the Apigee docs, Javascript policy can be used to rewrite the target url.
However, the solution provided in docs is vulnerable to HTTP parameter pollution, since Apigee decodes all parameters extracted either via ExtractVariables policy or via request.* object.
Moreover, an attacker can add hash ("#") which may result to unexpected behavior of target system, since part of the target request query may be omitted.
And as I see, many developers rely on this solution 😢.
To mitigate the issue above please add a statement about url encoding before constructing target url
LinkedIn
Twitter
