TykTechnologies/tyk: gateway/middleware.go; 134 LoC

Found a possible issue in [TykTechnologies/tyk](https://www.github.com/TykTechnologies/tyk) at [gateway/middleware.go](https://github.com/TykTechnologies/tyk/blob/0395ad6567013918af23d2b69c18317d592e2174/gateway/middleware.go#L385-L518)

Below is the message reported by the analyzer for this snippet of code. Beware that the analyzer only reports the first issue it finds, so please do not limit your consideration to the contents of the below message.

> reference to v is reassigned at line 386

[Click here to see the code in its original context.](https://github.com/TykTechnologies/tyk/blob/0395ad6567013918af23d2b69c18317d592e2174/gateway/middleware.go#L385-L518)

Click here to show the 134 line(s) of Go which triggered the analyzer.

```go
for k, v := range policy.AccessRights {
ar := &v

if v.Limit == nil {
v.Limit = &user.APILimit{}
}

if !usePartitions || policy.Partitions.Acl {
didACL[k] = true

// Merge ACLs for the same API
if r, ok := rights[k]; ok {
r.Versions = appendIfMissing(rights[k].Versions, v.Versions...)

for _, u := range v.AllowedURLs {
found := false
for ai, au := range r.AllowedURLs {
if u.URL == au.URL {
found = true
r.AllowedURLs[ai].Methods = append(au.Methods, u.Methods...)
}
}

if !found {
r.AllowedURLs = append(r.AllowedURLs, v.AllowedURLs...)
}
}

for _, t := range v.RestrictedTypes {
for ri, rt := range r.RestrictedTypes {
if t.Name == rt.Name {
r.RestrictedTypes[ri].Fields = intersection(rt.Fields, t.Fields)
}
}
}

mergeFieldLimits := func(res *user.FieldLimits, new user.FieldLimits) {
if greaterThanInt(new.MaxQueryDepth, res.MaxQueryDepth) {
res.MaxQueryDepth = new.MaxQueryDepth
}
}

for _, far := range v.FieldAccessRights {
exists := false
for i, rfar := range r.FieldAccessRights {
if far.TypeName == rfar.TypeName && far.FieldName == rfar.FieldName {
exists = true
mergeFieldLimits(&r.FieldAccessRights[i].Limits, far.Limits)
}
}

if !exists {
r.FieldAccessRights = append(r.FieldAccessRights, far)
}
}

ar = &r
}

ar.Limit.SetBy = policy.ID
}

if !usePartitions || policy.Partitions.Quota {
didQuota[k] = true
if greaterThanInt64(policy.QuotaMax, ar.Limit.QuotaMax) {

ar.Limit.QuotaMax = policy.QuotaMax
//if partition for quota is set the we must use this value in the global information of the key
if greaterThanInt64(policy.QuotaMax, session.QuotaMax) || policy.Partitions.Quota {
session.QuotaMax = policy.QuotaMax
}
}

if policy.QuotaRenewalRate > ar.Limit.QuotaRenewalRate {
ar.Limit.QuotaRenewalRate = policy.QuotaRenewalRate
if policy.QuotaRenewalRate > session.QuotaRenewalRate {
session.QuotaRenewalRate = policy.QuotaRenewalRate
}
}
}

if !usePartitions || policy.Partitions.RateLimit {
didRateLimit[k] = true

if greaterThanFloat64(policy.Rate, ar.Limit.Rate) {
ar.Limit.Rate = policy.Rate
//if policy.Partitions.RateLimit then we must set this value in the global data of the key
if greaterThanFloat64(policy.Rate, session.Rate) || policy.Partitions.RateLimit {
session.Rate = policy.Rate
}
}

if policy.Per > ar.Limit.Per {
ar.Limit.Per = policy.Per
if policy.Per > session.Per {
session.Per = policy.Per
}
}

if policy.ThrottleRetryLimit > ar.Limit.ThrottleRetryLimit {
ar.Limit.ThrottleRetryLimit = policy.ThrottleRetryLimit
if policy.ThrottleRetryLimit > session.ThrottleRetryLimit {
session.ThrottleRetryLimit = policy.ThrottleRetryLimit
}
}

if policy.ThrottleInterval > ar.Limit.ThrottleInterval {
ar.Limit.ThrottleInterval = policy.ThrottleInterval
if policy.ThrottleInterval > session.ThrottleInterval {
session.ThrottleInterval = policy.ThrottleInterval
}
}
}

if !usePartitions || policy.Partitions.Complexity {
didComplexity[k] = true

if greaterThanInt(policy.MaxQueryDepth, ar.Limit.MaxQueryDepth) {
ar.Limit.MaxQueryDepth = policy.MaxQueryDepth
if greaterThanInt(policy.MaxQueryDepth, session.MaxQueryDepth) {
session.MaxQueryDepth = policy.MaxQueryDepth
}
}
}

// Respect existing QuotaRenews
if r, ok := session.GetAccessRightByAPIID(k); ok && r.Limit != nil {
ar.Limit.QuotaRenews = r.Limit.QuotaRenews
}

if !usePartitions || policy.Partitions.Acl {
rights[k] = *ar
}
}

```

Leave a reaction on this issue to contribute to the project by classifying this instance as a **Bug** :-1:, **Mitigated** :+1:, or **Desirable Behavior** :rocket:
See the descriptions of the classifications [here](https://github.com/github-vet/rangeclosure-findings#how-can-i-help) for more information.

commit ID: 0395ad6567013918af23d2b69c18317d592e2174