casbin / lua-casbin

An authorization library that supports access control models like ACL, RBAC, ABAC in Lua (Kong, APISIX, OpenResty)
Apache License 2.0
55 stars 18 forks source link

ERROR: invalid request size #152

Open tom2nonames opened 1 year ago

tom2nonames commented 1 year ago

test code


local Enforcer1 = require("casbin")
local Enforcer2 = require("casbin")

local model1 = [[ [request_definition] r = path, method

[policy_definition]
p = path, method, eft

[policy_effect]
e = some(where (p.eft == allow)) && !some(where (p.eft == deny))

[matchers]
m = regexMatch(r.path, p.path) && keyMatch(r.method, p.method)

]]

local policy1 =[[ p, ^/cate/sample/gen_label_no, POST, allow p, ^/cate/sample/.*/[print|reprint], PUT, allow ]]

local model2 = [[ [request_definition] r = user, path, method

[policy_definition] p = role, path, method

[roledefinition] g = , _

[policy_effect] e = some(where (p.eft == allow))

[matchers] m = (g(r.user, p.role) || keyMatch(r.user, p.role)) && regexMatch(r.path, p.path) && keyMatch(r.method, p.method) ]]

local policy2 =[[

p, , ^/$, GET p, , ^/portal, GET p, *, ^/admin, GET

p, sys-admin, , g, sys-admin, guests ]]

local ex2 = Enforcer2:newEnforcerFromText(model2, policy2)

local pass2 = ex2:enforce("guests", "/", "GET") print( "pass2:",pass2)

local ex1 = Enforcer1:newEnforcerFromText(model1, policy1)

local pass1 = ex1:enforce("/cate/sample/gen_label_no", "POST") print( "pass1: ",pass1)

local pass3 = ex2:enforce("guests", "/", "GET")

print( "pass3: ",pass3)



>error info
~~~text
$ resty t-casbin.lua                                                                                                                                           [18:08:36]
2023/10/05 18:08:38 [warn] 2508#0: *2 [lua] _G write guard:12: __newindex(): writing a global Lua variable ('logging') which may lead to race conditions between concurrent requests, so prefer the use of 'local' variables
stack traceback:
        /usr/local/openresty/luajit/share/lua/5.1/logging.lua:465: in main chunk
        [C]: in function 'require'
        /usr/local/openresty/luajit/share/lua/5.1/src/util/Log.lua:15: in main chunk
        [C]: in function 'require'
        ...ocal/openresty/luajit/share/lua/5.1/src/model/Policy.lua:16: in main chunk
        [C]: in function 'require'
        ...local/openresty/luajit/share/lua/5.1/src/model/Model.lua:16: in main chunk
        [C]: in function 'require'
        ...openresty/luajit/share/lua/5.1/src/main/CoreEnforcer.lua:18: in main chunk
        [C]: in function 'require'
        ...
        ...sty/luajit/share/lua/5.1/src/main/ManagementEnforcer.lua:15: in main chunk
        [C]: in function 'require'
        ...cal/openresty/luajit/share/lua/5.1/src/main/Enforcer.lua:15: in main chunk
        [C]: in function 'require'
        /usr/local/openresty/luajit/share/lua/5.1/casbin.lua:16: in main chunk
        [C]: in function 'require'
        t-casbin.lua:1: in function 'file_gen'
        init_worker_by_lua(nginx.conf:185):45: in function <init_worker_by_lua(nginx.conf:185):43>
        [C]: in function 'xpcall'
        init_worker_by_lua(nginx.conf:185):52: in function <init_worker_by_lua(nginx.conf:185):50>, context: ngx.timer
INFOModel: 

INFO[e.e]:
INFO{RM = {}, key = "e", policy = {}, policyMap = {}, priorityIndex = -1, tokens = {}, value = "some(where (p_eft == allow))"}
INFO[g.g]:
INFO{RM = {}, key = "g", policy = {}, policyMap = {}, priorityIndex = -1, tokens = {}, value = "_, _"}
INFO[r.r]:
INFO{RM = {}, key = "r", policy = {}, policyMap = {}, priorityIndex = -1, tokens = {"r_user", "r_path", "r_method"}, value = "user, path, method"}
INFO[p.p]:
INFO{RM = {}, key = "p", policy = {}, policyMap = {}, priorityIndex = -1, tokens = {"p_role", "p_path", "p_method"}, value = "role, path, method"}
INFO[m.m]:
INFO{RM = {}, key = "m", policy = {}, policyMap = {}, priorityIndex = -1, tokens = {}, value = "(g(r_user, p_role) || keyMatch(r_user, p_role)) && regexMatch(r_path, p_path) && keyMatch(r_method, p_method)"}
INFORequest: guests, /, GET ---> true
Hit Policy: { *, ^/$, GET }
pass2:true
INFOModel: 

INFO[p.p]:
INFO{RM = {}, key = "p", policy = {}, policyMap = {}, priorityIndex = -1, tokens = {"p_path", "p_method", "p_eft"}, value = "path, method, eft"}
INFO[m.m]:
INFO{RM = {}, key = "m", policy = {}, policyMap = {}, priorityIndex = -1, tokens = {}, value = "regexMatch(r_path, p_path) && keyMatch(r_method, p_method)"}
INFO[e.e]:
INFO{RM = {}, key = "e", policy = {}, policyMap = {}, priorityIndex = -1, tokens = {}, value = "some(where (p_eft == allow)) && !some(where (p_eft == deny))"}
INFO[r.r]:
INFO{RM = {}, key = "r", policy = {}, policyMap = {}, priorityIndex = -1, tokens = {"r_path", "r_method"}, value = "path, method"}
INFORequest: /cate/sample/gen_label_no, POST ---> true

pass1: true
ERROR: ...openresty/luajit/share/lua/5.1/src/main/CoreEnforcer.lua:407: invalid request size
stack traceback:
        ...openresty/luajit/share/lua/5.1/src/main/CoreEnforcer.lua:407: in function 'enforceEx'
        ...openresty/luajit/share/lua/5.1/src/main/CoreEnforcer.lua:534: in function 'enforce'
        t-casbin.lua:78: in function 'file_gen'
        init_worker_by_lua(nginx.conf:185):45: in function <init_worker_by_lua(nginx.conf:185):43>
        [C]: in function 'xpcall'
        init_worker_by_lua(nginx.conf:185):52: in function <init_worker_by_lua(nginx.conf:185):50>
~~~
casbin-bot commented 1 year ago

@Edmond-J-A @rushitote @techoner

hsluoyz commented 1 year ago

@tom2nonames what Casbin version are you using? I noticed that you are using openresty, so is it a customzized Casbin version shipped by openresty?

The official latest release is v1.41.8: https://github.com/casbin/lua-casbin/releases/tag/v1.41.8 , you should try this

tom2nonames commented 1 year ago

what Casbin version are you using? I noticed that you are using openresty, so is it a customzized Casbin version shipped by openresty?

The casbin version I am using is v1.41.1-1, installed using the Lualocks package manager and running in the openrest/1.21.4.2RC1 environment. I will try v1.41.8-1 first.

tom2nonames commented 1 year ago

what Casbin version are you using? I noticed that you are using openresty, so is it a customzized Casbin version shipped by openresty?

The casbin version I am using is v1.41.1-1, installed using the Lualocks package manager and running in the openrest/1.21.4.2RC1 environment. I will try v1.41.8-1 first.

I have updated the version and still have the same issue.