[TT-10626] extended_paths path handling is inconsistent about tyk

[andyo-tyk]

Hi @jakub-bochenski,

Thanks for flagging this - it looks like we've got a real muddle of inconsistency there. It will be difficult to align everything without making breaking changes, but this is now on my radar. We should definitely be able to improve things in our Tyk OAS functionality, though the Tyk Classic will be tricky or impossible to resolve.

In terms of the documentation, I've raised a ticket internally to improve this so that - even if the behaviour is inconsistent between different fields - we make it as clear as possible what rules are applied where.

Thanks again for your support - I'll leave this open until we've managed to improve the docs.

[hbirkdale]

I can add to this. We tested with two endpoints:
/ping
/core/ping

We put in the white_list /ping, and it is allowed, but core/ping also now is allowed. I would think this needs to be strict or clearly documented. I put /ping in the white list, and its the only endpoint in the white list, then suddenly allowing /core/ping makes no sense. I get the fact that $ at the end will stop /ping/core - but what about at the beginning of the url?