API Changes

no api changes detected

This PR addresses an issue with how Javascript-style regular expressions containing unicode escape sequences (e.g., \u0000) are handled in OAS API definitions. The gateway's internal RE2 regex engine uses a different format, which previously caused these patterns to be misinterpreted. This fix introduces a transformation layer to correctly process these patterns internally while preserving the original format for users.

Files Changed Analysis

• gateway/api.go: Implements the core transformation logic at the API boundaries. On ingestion (extractOASObjFromReq), it converts Javascript unicode escapes to the RE2 format. On egress (handleGetAPIOAS, writeOASAndAPIDefToFile), it clones the cached OAS object and restores the original Javascript format before responding or writing to a file. Cloning is critical to prevent mutating the shared in-memory API definition.
• gateway/api_definition.go: Applies the same ingestion logic for OAS APIs loaded from files (loadDefFromFilePath), ensuring consistent behavior regardless of the source.
• gateway/api_definition_test.go: Adds a new test suite (TestLoadDefFromFilePath) to validate the file-loading process and specifically verify that the regex unicode transformation is applied correctly.

Architecture & Impact Assessment

• What this PR accomplishes: It fixes a bug causing incorrect validation for OAS APIs that use regex patterns with unicode escapes. It ensures these patterns are correctly interpreted by the gateway's RE2 engine while preserving the original Javascript format for external representations.

• Key technical changes introduced:

  1. Bidirectional Regex Transformation: A schema.Visitor is used to convert Javascript-style unicode escapes (\u...) to a Go-compatible RE2 format (\x{...}) on ingestion and reverts this on egress.
  2. State Isolation via Cloning: The handleGetAPIOAS and writeOASAndAPIDefToFile functions now clone the OAS object from the cache before applying the reverse transformation. This is a crucial defensive measure to prevent race conditions and state corruption of the live API definition.
  3. Consistent Handling: The transformation is applied across all entry and exit points for an OAS definition: API creation/update (HTTP), API retrieval (HTTP), file writing, and file loading.

• Affected system components: This change impacts the lifecycle management of OAS API definitions within the Tyk Gateway, specifically any validation that relies on regex patterns with unicode characters.

OAS Regex Handling Flow

graph TD
    subgraph Ingestion [API Definition Ingestion]
        A["HTTP Request (Create/Update API) <br>w/ JS Regex \\u..."] --> B{extractOASObjFromReq};
        C["API Definition File <br>w/ JS Regex \\u..."] --> D{loadDefFromFilePath};
        E((In-Memory Cache <br> with RE2 Regex));
        B --|Transform JS \\u to RE2 \\x(...)|--> E;
        D --|Transform JS \\u to RE2 \\x(...)|--> E;
    end

    subgraph Egress [API Definition Egress]
        F["HTTP Request (Get API)"] --> G{handleGetAPIOAS};
        J["Write to File Trigger"] --> K{writeOASAndAPIDefToFile};

        G --|1. Get from Cache|--> E;
        E --|2. Clone Object|--> H[Cloned OAS Object];
        H --|3. Restore RE2 \\x(...) to JS \\u|--> I["HTTP Response <br> w/ JS Regex \\u..."];

        K --|1. Get from Cache|--> E;
        E --|2. Clone Object|--> L[Cloned OAS Object];
        L --|3. Restore RE2 \\x(...) to JS \\u|--> M["API Definition File <br> w/ JS Regex \\u..."];
    end

Scope Discovery & Context Expansion

• The changes are well-contained within the gateway package but are fundamental to the data integrity of all OAS API definitions that use regex validation with unicode characters.
• The core transformation logic (TransformUnicodeEscapesToRE2Manipulation and RestoreUnicodeEscapesFromRE2Manipulation) is located in the pkg/schema package (not modified in this PR), indicating a clean separation of concerns.
• The new test TestLoadDefFromFilePath provides essential coverage for the file-loading scenario, which is a key ingestion path alongside the main HTTP API.

References

• gateway/api.go: Implements the core logic for cloning, transformation, and restoration of OAS definitions at the API and file system boundaries.
• gateway/api_definition.go: Applies transformation logic to definitions loaded from files.
• gateway/api_definition_test.go: Contains new tests for the file loading and transformation logic.

Powered by Visor from Probelabs

Last updated: 2026-04-16T05:20:59.079Z | Triggered by: pr_updated | Commit: be3b306

💡 TIP: You can chat with Visor using /visor ask <your question>

Security Issues (2)

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

Security Issues (2)

No architecture issues found – changes LGTM.

Performance Issues (2)

Quality Issues (2)

Powered by Visor from Probelabs

Last updated: 2026-04-16T05:20:55.393Z | Triggered by: pr_updated | Commit: be3b306

💡 TIP: You can chat with Visor using /visor ask <your question>

/Visor ask Function apiOAS.Clone() always return nil as an error - that is why it is ignored here. OAS clone is returned from this function to the handlers which can modify it's state with schema visitor (and we do not want those changes to be propagated into cache).

Powered by Visor from Probelabs

Last updated: 2026-03-27T09:08:02.067Z | Triggered by: MaciekMis | Commit: 5cb4b4b

💡 TIP: You can chat with Visor using /visor ask <your question>

🚨 Jira Linter Failed

Commit: be3b306
Failed at: 2026-04-16 09:56:51 UTC

The Jira linter failed to validate your PR. Please check the error details below:

failed to get Jira issue: failed to fetch Jira issue TT-12238: Issue does not exist or you do not have permission to see it.: request failed. Please analyze the request body for more details. Status code: 404

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

/release to release-5.8

⚠️ Cherry-pick encountered conflicts. A draft PR was created: #8061