uri-normalization-review

Reviewing URI normalization rules for safe gateway API ACLs involves mapping closed versus still-reportable bypass scenarios. You must evaluate DSL decision logic, routing correctness, and rewrite behavior to identify configuration boundaries and enforce lint rules that prevent unsafe raw path access.

URI normalization bypass scenarios requiring security reporting include DSL misuse, ineffective regex patterns, and mismatched request semantics. You must flag deny-list entries assuming raw behavior and invalid forward-raw-path annotations to identify configuration boundaries for safer operator remediation.

Linting DSL code to prevent raw URI path reading requires enforcing two mandatory constraints: avoiding direct reads of raw URI paths and avoiding bare writes. You must define two legal write points that keep normalized path caches consistent for ACL decision logic.

You need to audit URI normalization for Gateway API routing correctness during gateway design and DSL plugin code changes. This prevents security review blind spots by clarifying which bypass scenarios are closed and which require reporting, linting, or operator action.

ACL deny-list rules are ineffective after URI normalization when regex or deny-list entries assume raw path behavior instead of normalized semantics. This mismatch creates security review blind spots that require configuration fixes to align with rewrite behavior and routing correctness.

Yes, uri-normalization-review identifies operator configuration pitfalls including invalid forward-raw-path annotation values and mismatches between request and raw semantics. It flags commit-scope boundaries and configuration pitfalls that assume raw behavior for safer operator remediation.