routecollisions

Overview ¶

Command routecollisions regenerates the RouteMatcher over-claim candidate list for gopherstack-op3e (see services/_ROUTE_COLLISIONS.md).

gopherstack-op3e found that inspector2 and macie2 both claimed "/findings*" and "/members*" unconditionally in their RouteMatcher, and both register (cli.go's getServiceProviders chain) before securityhub -- so pkgs/service/router.go, which evaluates matchers in priority order and takes the first that returns true, sent every securityhub findings/members request to the wrong service. Unit tests never caught it because they call h.Handler() directly, bypassing RouteMatcher and the router entirely. This tool asks the opposite of what a prior sweep (gopherstack-k9bl) asked -- not "does each matcher accept its own paths" but "does it also accept paths that belong to somebody else."

For every services/<dir>, it parses every non-test .go file with go/ast, locates each RouteMatcher() service.Matcher method (there can be more than one per package: bedrock's agents dispatcher, redshift's serverless handler, s3/dynamodb's differently-named receivers), and extracts the path-prefix string literals it tests against the request path -- both literal ("/findings/") and package-const-resolved ("/"+pathAnalyzer). It also resolves each service's MatchPriority() and its registration order from cli.go's getServiceProviders chain, and flags whether the matcher already gates any of its claims behind a SigV4 signing-service check (httputils.ExtractServiceFromRequest, or a local isXRequest helper) -- the established disambiguation pattern (securityhub, mediapackage, iot, managedblockchain, ...).

This is a CANDIDATE list only, built by text/regex extraction over a RouteMatcher body -- it does not simulate the router. A flagged "collision" still needs a human read of both services' matchers (prefix vs. exact, nested-path narrowing, an existing guard that isn't reflected in this coarse per-service "guarded" bit) before it is a confirmed bug -- see services/_ROUTE_COLLISIONS.md for the triage already done.

Usage:

go run ./cmd/routecollisions            # ranked collision summary to stdout
go run ./cmd/routecollisions -json out.json   # full per-service claim detail