API Changes

--- prev.txt	2025年10月14日 12:44:46.085105890 +0000
+++ current.txt	2025年10月14日 12:44:36.618225843 +0000
@@ -6879,6 +6879,8 @@
 	// If you set this value to `true`, then the id parameter in a stored policy (or imported policy using the Dashboard API), will be used instead of the internal ID.
 	//
 	// This option should only be used when moving an installation to a new database.
+	//
+	// Deprecated. Is not used in codebase.
 	AllowExplicitPolicyID bool `json:"allow_explicit_policy_id"`
 	// This option only applies in OSS deployment when the `policies.policy_source` is either set
 	// to `file` or an empty string. If `policies.policy_path` is set, then Tyk will load policies
@@ -10009,11 +10011,11 @@
 
 func (gw *Gateway) LoadDefinitionsFromRPCBackup() ([]*APISpec, error)
 
-func (gw *Gateway) LoadPoliciesFromDashboard(endpoint, secret string, allowExplicit bool) (map[string]user.Policy, error)
+func (gw *Gateway) LoadPoliciesFromDashboard(endpoint, secret string) (map[string]user.Policy, error)
 LoadPoliciesFromDashboard will connect and download Policies from a Tyk
 Dashboard instance.
 
-func (gw *Gateway) LoadPoliciesFromRPC(store RPCDataLoader, orgId string, allowExplicit bool) (map[string]user.Policy, error)
+func (gw *Gateway) LoadPoliciesFromRPC(store RPCDataLoader, orgId string) (map[string]user.Policy, error)
 
 func (gw *Gateway) LoadPoliciesFromRPCBackup() (map[string]user.Policy, error)
 

🔍 Code Analysis Results

This PR standardizes policy identification by deprecating the AllowExplicitPolicyID configuration and consistently using the policy.ID field. It removes the conditional logic that previously switched between policy.ID and the internal MongoDB ID (MID), simplifying policy loading from the Dashboard and RPC. For backward compatibility, a new ensurePolicyId function backfills policy.ID from MID if it's empty.

A major enhancement is the introduction of a new internal/osutil package, which provides sandboxed file system operations. This is used in the policy management API (gateway/api.go) to prevent path traversal vulnerabilities when creating, updating, or deleting policy files. All related function signatures and tests have been updated to reflect these changes.

Files Changed Analysis

• Total Files Changed: 8
• Additions/Deletions: 397 additions, 71 deletions.
• Notable Patterns:
  • New Security Utility: The addition of internal/osutil/osutil.go and its corresponding tests introduces a reusable, secure file I/O module to prevent path traversal.
  • Refactoring for Simplicity: The core logic in gateway/policy.go is simplified by removing the allowExplicit parameter and its associated branching, leading to cleaner code.
  • Security Hardening: gateway/api.go is refactored to replace direct file system calls (ioutil.WriteFile, os.Remove, os.Stat) with the new secure osutil wrapper.
  • API Simplification: Function signatures in gateway/policy.go, gateway/server.go, and gateway/rpc_backup_handlers.go are cleaned up by removing the now-redundant allowExplicit parameter.
  • Test Adaptation: gateway/policy_test.go is significantly modified to align with the new standardized ID handling and simplified function signatures.

Architecture & Impact Assessment

What this PR accomplishes

This PR resolves inconsistencies in how policies are identified, making the gateway's behavior more predictable and the codebase easier to maintain. It eliminates a confusing configuration flag and enforces a single source of truth for policy IDs. Critically, it also hardens the file-based policy management API against path traversal attacks.

Key technical changes introduced

1. Policy ID Standardization: The system now exclusively uses policy.ID as the unique identifier for policies in memory.
2. Configuration Deprecation: The policies.allow_explicit_policy_id configuration option is marked as deprecated and is no longer used.
3. Secure File Operations: A new internal/osutil package sandboxes file system access to a specific root directory, preventing malicious file paths from escaping the intended directory.
4. Backward Compatibility: The ensurePolicyId function ensures that policies loaded without an ID have it populated from their MID (MongoDB _id), ensuring a smooth transition for existing deployments.
5. API Simplification: The allowExplicit parameter was removed from LoadPoliciesFromDashboard, LoadPoliciesFromRPC, and parsePoliciesFromRPC, resulting in a cleaner internal API.

Affected system components

• Gateway Configuration: The allow_explicit_policy_id setting is now obsolete.
• Policy Loading: Logic for loading policies from the Tyk Dashboard, RPC, and file system is unified.
• Gateway REST API: The /tyk/policies/* endpoints are now more secure due to sandboxed file I/O.
• RPC Backup & Restore: The policy restoration mechanism is updated to use the new standardized parsing logic.

Component Interaction Diagrams

Policy ID Handling: Before vs. After

graph TD
 subgraph Before
 A[Policy Source] --> B{allow_explicit_policy_id?}
 B -- "True & ID exists" --> C[Use policy.ID]
 B -- "False or ID empty" --> D[Use policy.MID]
 end
 subgraph After
 E[Policy Source] --> F[ensurePolicyId(policy)]
 F -- "Backfills ID from MID if empty" --> G[Use policy.ID]
 end

Secure Policy File Handling

sequenceDiagram
 participant API as "Gateway API Handler"
 participant Osutil as "osutil.Root"
 participant FS as "File System"
 API->>Osutil: NewRoot(policyPath)
 API->>Osutil: WriteFile("policy-id.json", data)
 Osutil->>Osutil: Ensure path is within root
 alt Path is safe
 Osutil->>FS: os.WriteFile(fullPath, data)
 else Path is unsafe (e.g., ../../etc/passwd)
 Osutil-->>API: Return error
 API-->>Client: HTTP 500
 end

Scope Discovery & Context Expansion

The changes are primarily contained within the gateway's policy management subsystem. The most significant architectural change is the introduction of the internal/osutil package. This utility is a valuable addition for security hardening and could be adopted in other parts of the codebase that perform file I/O based on user-provided or API-driven paths (e.g., API definition management).

The deprecation of AllowExplicitPolicyID is a minor breaking change for operators who relied on this niche feature, but the backward-compatibility logic ensures that existing policies will continue to load correctly. The overall impact is a more robust, secure, and maintainable policy management system.

Powered by Visor from Probelabs

Last updated: 2025年10月14日T13:07:49.473Z | Triggered by: synchronize | Commit: 8ab4b09

Quality Gate Failed Quality Gate failed

Failed conditions
73.5% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud