From 77edb373a0d1183d6338a103ad8d4b82a4b7f56e Mon Sep 17 00:00:00 2001 From: Abhishek Kumar Date: Tue, 4 Nov 2025 17:52:30 +0530 Subject: [PATCH 1/3] server: control honouring internal IDs by old APIs Fixes #9684 Signed-off-by: Abhishek Kumar --- .../src/main/java/com/cloud/api/ApiServer.java | 16 +++++++++++++++- .../cloud/api/dispatch/ParamProcessWorker.java | 3 ++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/server/src/main/java/com/cloud/api/ApiServer.java b/server/src/main/java/com/cloud/api/ApiServer.java index c78ac05102f8..7a529db658cc 100644 --- a/server/src/main/java/com/cloud/api/ApiServer.java +++ b/server/src/main/java/com/cloud/api/ApiServer.java @@ -348,6 +348,19 @@ public class ApiServer extends ManagerBase implements HttpRequestHandler, ApiSer , ConfigKey.Scope.Global, null, null, null, null, null, ConfigKey.Kind.Select, EnumSet.allOf(ApiSessionKeyCheckOption.class).stream().map(Enum::toString).collect(Collectors.joining(", "))); + public static final ConfigKey ApiDisallowInternalIds = new ConfigKey<>( + ConfigKey.CATEGORY_ADVANCED, + Boolean.class, + "api.disallow.internal.ids", + "false", + "When enabled, APIs will not honour requests containing internal database IDs. " + + "Only UUIDs will be accepted as entity identifiers. " + + "By default, internal IDs are still accepted for backward compatibility with pre-3.x APIs.", + true, + ConfigKey.Scope.Global + ); + + @Override public boolean configure(final String name, final Map params) throws ConfigurationException { messageBus.subscribe(AsyncJob.Topics.JOB_EVENT_PUBLISH, MessageDispatcher.getDispatcher(this)); @@ -1685,7 +1698,8 @@ public ConfigKey[] getConfigKeys() { useForwardHeader, listOfForwardHeaders, ApiSessionKeyCookieSameSiteSetting, - ApiSessionKeyCheckLocations + ApiSessionKeyCheckLocations, + ApiDisallowInternalIds }; } } diff --git a/server/src/main/java/com/cloud/api/dispatch/ParamProcessWorker.java b/server/src/main/java/com/cloud/api/dispatch/ParamProcessWorker.java index c4145755b560..1ca6c347546f 100644 --- a/server/src/main/java/com/cloud/api/dispatch/ParamProcessWorker.java +++ b/server/src/main/java/com/cloud/api/dispatch/ParamProcessWorker.java @@ -51,6 +51,7 @@ import org.apache.logging.log4j.Logger; import org.apache.logging.log4j.LogManager; +import com.cloud.api.ApiServer; import com.cloud.exception.InvalidParameterValueException; import com.cloud.user.Account; import com.cloud.user.AccountManager; @@ -510,7 +511,7 @@ private Long translateUuidToInternalId(final String uuid, final Parameter annota } Long internalId = null; // If annotation's empty, the cmd existed before 3.x try conversion to long - final boolean isPre3x = annotation.since().isEmpty(); + final boolean isPre3x = annotation.since().isEmpty() && !ApiServer.ApiDisallowInternalIds.value(); // Match against Java's UUID regex to check if input is uuid string final boolean isUuid = UuidUtils.isUuid(uuid); // Enforce that it's uuid for newly added apis from version 3.x From 578681d0e3065ab03e5a9ee9ca1406d3370b6421 Mon Sep 17 00:00:00 2001 From: Abhishek Kumar Date: Mon, 13 Jul 2026 12:34:08 +0530 Subject: [PATCH 2/3] Apply suggestion from @shwstppr --- server/src/main/java/com/cloud/api/ApiServer.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/main/java/com/cloud/api/ApiServer.java b/server/src/main/java/com/cloud/api/ApiServer.java index 7a529db658cc..e1387840de80 100644 --- a/server/src/main/java/com/cloud/api/ApiServer.java +++ b/server/src/main/java/com/cloud/api/ApiServer.java @@ -352,7 +352,7 @@ public class ApiServer extends ManagerBase implements HttpRequestHandler, ApiSer ConfigKey.CATEGORY_ADVANCED, Boolean.class, "api.disallow.internal.ids", - "false", + "true", "When enabled, APIs will not honour requests containing internal database IDs. " + "Only UUIDs will be accepted as entity identifiers. " + "By default, internal IDs are still accepted for backward compatibility with pre-3.x APIs.", From a6fe49ea17d065ecdd3477bba4daf42980fa07b2 Mon Sep 17 00:00:00 2001 From: Abhishek Kumar Date: Mon, 13 Jul 2026 12:34:59 +0530 Subject: [PATCH 3/3] Apply suggestion from @shwstppr --- server/src/main/java/com/cloud/api/ApiServer.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/main/java/com/cloud/api/ApiServer.java b/server/src/main/java/com/cloud/api/ApiServer.java index e1387840de80..7c6212afa3e4 100644 --- a/server/src/main/java/com/cloud/api/ApiServer.java +++ b/server/src/main/java/com/cloud/api/ApiServer.java @@ -355,7 +355,7 @@ public class ApiServer extends ManagerBase implements HttpRequestHandler, ApiSer "true", "When enabled, APIs will not honour requests containing internal database IDs. " + "Only UUIDs will be accepted as entity identifiers. " - + "By default, internal IDs are still accepted for backward compatibility with pre-3.x APIs.", + + "By default, internal IDs are not accepted even for pre-3.x APIs.", true, ConfigKey.Scope.Global );