🔄 Preview: [TT-16948, TT-6176] Documenting custom plugin changes in 5.15 - #2779
Draft
probelabs[bot] wants to merge 477 commits into
Draft
🔄 Preview: [TT-16948, TT-6176] Documenting custom plugin changes in 5.15#2779probelabs[bot] wants to merge 477 commits into
probelabs[bot] wants to merge 477 commits into
probelabs / Visor: security
succeeded
Aug 24, 2026 in 1m 4s
✅ Check Passed (Warnings Found)
security check passed. Found 4 warnings, but fail_if condition was not met.
Details
📊 Summary
- Total Issues: 4
- Warning Issues: 4
🔍 Failure Condition Results
Passed Conditions
- global_fail_if: Condition passed
Issues by Category
Security (4)
⚠️ api-management/plugins/javascript.mdx:501 - The documentation for Atomic Storage Bindings correctly identifies that plugins share a single Redis keyspace with no per-plugin or per-API isolation. This creates a significant risk of key collisions, where one plugin could read, overwrite, or delete the data of another, potentially leading to security vulnerabilities like bypassing rate limits, custom authorization checks, or causing denial of service. The current warning does not provide actionable guidance on how to mitigate this risk.⚠️ api-management/plugins/javascript.mdx:655 - The documentation correctly warns that an inline JavaScript plugin will silently fail to load if thedriveris not set tojavascript. While the operational impact is mentioned ('plugin loads nothing'), the severe security implications are not explicitly stated. A silent failure of a security-critical plugin (e.g., for custom authentication or request validation) is a high-risk scenario that can lead to a false sense of security.⚠️ api-management/plugins/overview.mdx:600 - The documentation correctly warns that an inline JavaScript plugin will silently fail to load if thedriveris not set tojavascript. While the operational impact is mentioned ('loads nothing, silently'), the severe security implications are not explicitly stated. A silent failure of a security-critical plugin is a high-risk scenario that can lead to a false sense of security.⚠️ api-management/plugins/plugin-types.mdx:325 - The documentation explains that an analytics plugin defined in a bundle's manifest is activated automatically. This behavior introduces a potential supply chain risk. If a user consumes a third-party or compromised bundle, a malicious analytics plugin could be silently activated, giving it access to all traffic data and potentially exfiltrating sensitive information.
Powered by Visor from Probelabs
💡 TIP: You can chat with Visor using /visor ask <your question>
Annotations
Check warning on line 504 in api-management/plugins/javascript.mdx
probelabs / Visor: security
security Issue
The documentation for Atomic Storage Bindings correctly identifies that plugins share a single Redis keyspace with no per-plugin or per-API isolation. This creates a significant risk of key collisions, where one plugin could read, overwrite, or delete the data of another, potentially leading to security vulnerabilities like bypassing rate limits, custom authorization checks, or causing denial of service. The current warning does not provide actionable guidance on how to mitigate this risk.
Raw output
Enhance the warning to strongly recommend a key namespacing strategy to ensure isolation. For example, advise developers to prefix all keys with a unique identifier for the API and plugin, such as `API_ID:plugin_name:key`. This provides a concrete mitigation for the described risk.
Check warning on line 658 in api-management/plugins/javascript.mdx
probelabs / Visor: security
security Issue
The documentation correctly warns that an inline JavaScript plugin will silently fail to load if the `driver` is not set to `javascript`. While the operational impact is mentioned ('plugin loads nothing'), the severe security implications are not explicitly stated. A silent failure of a security-critical plugin (e.g., for custom authentication or request validation) is a high-risk scenario that can lead to a false sense of security.Raw output
Update the warning to explicitly state the security risk. For example, add: 'This silent failure can create a serious security vulnerability if the plugin is intended to perform authentication, authorization, or validation, as the API would be left unprotected without any error indication.'
Check warning on line 602 in api-management/plugins/overview.mdx
probelabs / Visor: security
security Issue
The documentation correctly warns that an inline JavaScript plugin will silently fail to load if the `driver` is not set to `javascript`. While the operational impact is mentioned ('loads nothing, silently'), the severe security implications are not explicitly stated. A silent failure of a security-critical plugin is a high-risk scenario that can lead to a false sense of security.Raw output
Update the warning to explicitly state the security risk, consistent with the more detailed documentation. For example, add: 'This can create a serious security vulnerability if the plugin is intended to perform security functions.'
Check warning on line 325 in api-management/plugins/plugin-types.mdx
probelabs / Visor: security
security Issue
The documentation explains that an analytics plugin defined in a bundle's manifest is activated automatically. This behavior introduces a potential supply chain risk. If a user consumes a third-party or compromised bundle, a malicious analytics plugin could be silently activated, giving it access to all traffic data and potentially exfiltrating sensitive information.
Raw output
Add a security warning to this section advising users to only use trusted plugin bundles and to always review the `manifest.json` file to understand all components that will be automatically activated. This encourages a secure supply chain practice.
Loading