Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: fix the double quotes caused eval() bug #443

Merged
merged 3 commits into from
Dec 2, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions src/main/java/org/casbin/jcasbin/main/CoreEnforcer.java
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,9 @@
import java.util.function.BiPredicate;
import java.util.function.Function;

import static org.casbin.jcasbin.util.Util.hasEval;
import static org.casbin.jcasbin.util.Util.splitCommaDelimitedList;

/**
* CoreEnforcer defines the core functionality of an enforcer.
*/
Expand Down Expand Up @@ -580,6 +583,7 @@ private EnforceResult enforce(String matcher, Object... rvals) {
} else {
expString = Util.removeComments(Util.escapeAssertion(matcher));
}
boolean hasEval = hasEval(expString);

// json process
if (acceptJsonRequest) {
Expand Down Expand Up @@ -629,6 +633,9 @@ private EnforceResult enforce(String matcher, Object... rvals) {

for (int i = 0; i < policy.size(); i++) {
List<String> pvals = policy.get(i);
if (hasEval) {
pvals = splitCommaDelimitedList(pvals);
}
Map<String, Object> parameters = new HashMap<>(rvals.length + pTokens.length);
getPTokens(parameters, pType, pvals, pTokens);
getRTokens(parameters, rType, rvals);
Expand Down
17 changes: 16 additions & 1 deletion src/main/java/org/casbin/jcasbin/util/Util.java
Original file line number Diff line number Diff line change
Expand Up @@ -284,6 +284,21 @@ public static String[] splitCommaDelimited(String s) {
return records;
}

/**
* splits each string in the given list by commas according to CSV format
* and removes any extra double quotes
* @param rule the rule to be modified
* @return the modified rule
*/
public static List<String> splitCommaDelimitedList(List<String> rule) {
List<String> modifiedRule = new ArrayList<>();
for (String s : rule) {
String[] strings = splitCommaDelimited(s);
modifiedRule.add(strings[0]);
}
return modifiedRule;
}

/**
* setEquals determines whether two string sets are identical.
*
Expand Down Expand Up @@ -314,7 +329,7 @@ public static boolean setEquals(List<String> a, List<String> b) {
}

public static boolean hasEval(String exp) {
return evalReg.matcher(exp).matches();
return evalReg.matcher(exp).find();
}

public static String replaceEval(String s, String replacement) {
Expand Down
13 changes: 12 additions & 1 deletion src/test/java/org/casbin/jcasbin/main/AbacAPIUnitTest.java
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,10 @@

package org.casbin.jcasbin.main;

import org.casbin.jcasbin.util.Util;
import org.junit.Test;

import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.HashMap;

Expand All @@ -42,6 +44,15 @@ public void testEval() {
alice.setAge(60);
testEnforce(e, alice, "/data2", "read", false);
testEnforce(e, alice, "/data2", "write", false);

List<String> rule = new ArrayList<>();
rule.add("\"r.sub.name == 'alice,green'\"");
rule.add("data1");
rule.add("read");
e.addPolicy(rule);

TestEvalRule aliceGreen = new TestEvalRule("alice,green", 18);
testEnforce(e, aliceGreen, "data1", "read", true);
}

@Test
Expand Down
8 changes: 8 additions & 0 deletions src/test/java/org/casbin/jcasbin/main/UtilTest.java
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import java.io.IOException;
import java.io.StringReader;

import static org.casbin.jcasbin.util.Util.hasEval;
import static org.junit.Assert.*;
import static org.mockito.ArgumentMatchers.*;

Expand Down Expand Up @@ -84,6 +85,13 @@ public void testSplitCommaDelimited(){
assertArrayEquals(new String[]{"a b", "c", "d"}, Util.splitCommaDelimited("\"a b\", c, d"));
}

@Test
public void testHasEval() {
assertTrue(hasEval("eval(test)"));
assertTrue(hasEval("r_act == p_act && eval(p_sub_rule) && eval(p_obj_rule)"));
assertFalse(hasEval("evaltest"));
}

@Test
public void testReplaceEval() {
Util.logPrint(Util.replaceEval("eval(test)", "testEval"));
Expand Down