wso2 / wso2/api-platform

request-rewrite: silent no-op for invalid path rewrite config and query reordering on path-only rewrite

Open
#1,297 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Area/Policies Type/Bug
Dominant language
Go
Stars
71
Forks
111
Avg merge
1d 14h
Merged PRs (30d)
110

Description

Summary

request-rewrite has three confirmed behavior issues that can hide configuration problems and change request semantics.

1) Invalid path regex is treated as silent no-op instead of config error

  • Example config:
pathRewrite:
  type: ReplaceRegexMatch
  replaceRegexMatch:
    pattern: "["
    substitution: "/x"
  • Actual: returns UpstreamRequestModifications with no rewrite (warn log only).
  • Expected: fail closed with a configuration error response.
  • Evidence:
    • Test: requestrewrite_test.go:1169
    • Behavior: requestrewrite.go:360-364

2) Unsupported pathRewrite.type is silently ignored

  • Example config:
pathRewrite:
  type: TypoRewriteType
  replaceFullPath: /x
  • Actual: warn + no-op, no failure response.
  • Expected: fail closed with a configuration error response.
  • Evidence:
    • Test: requestrewrite_test.go:1194
    • Behavior: requestrewrite.go:367-369

3) Path-only rewrites reorder query parameters

  • Example input:
    • Request path: /v1/orders/42?b=2&a=1
    • Rewrite: ReplaceFullPath to /new
  • Actual output: /v1/new?a=1&b=2 (query order changed)
  • Expected: preserve original query order for path-only rewrites.
  • Evidence:
    • Test: requestrewrite_test.go:1145
    • Cause: requestrewrite.go:467 (url.Values.Encode() canonicalization)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with requestrewrite.go at lines 360-369 and 467, then read the related cases in requestrewrite_test.go at lines 1145, 1169, and 1194. Confirm the existing behavior and update the tests so invalid regexes and unsupported types produce configuration errors while path-only rewrites preserve query order; done means all request-rewrite tests pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.