mlsen / casbin-redis-adapter

Redis Adapter for Casbin
Apache License 2.0
4 stars 5 forks source link

[bug]Lack of type judgment on the input string, resulting in authentication failure #1

Closed zj611 closed 2 years ago

zj611 commented 2 years ago

We found in testing that an input of unusual string type would cause the Enforce function to fail completely, as shown in the code block below. When calling the enforcer.Enforce function, an error of invalid policy size will be thrown, resulting in a failure to judge the permission.
//exception error: false invalid policy size: expected 3, got 1, pvals: [role::35046358490550272]

import (
    "fmt"
    "github.com/casbin/casbin/v2"
    redisAdapter "github.com/mlsen/casbin-redis-adapter/v2"
    "testing"
)
func TestRedisAdapter(t *testing.T)  {

    adapter, err := redisAdapter.NewFromURL("redis://:123@localhost:6379/0")
if err != nil{
    panic(err)
}

enforcer, err := casbin.NewEnforcer("model.conf", adapter)
if err != nil{
    panic(err)
}
enforcer.EnableAutoSave(true)

// Load policy from redis
enforcer.LoadPolicy()

// normal case
_, _ = enforcer.AddNamedPolicy("p", []string{"sub1", "obj1", "on"})
fmt.Println(enforcer.Enforce("sub1", "obj1","on"))

// exception case with newline character
sub2 := `role::35046358490550272
expr 855534449 + 870448142`
//it can be successfully inserted into redis list
_, _ = enforcer.AddNamedPolicy("p", []string{sub2, "obj2", "on"})

fmt.Println(enforcer.Enforce("sub1", "obj1", "on"))
//exception error: false invalid policy size: expected 3, got 1, pvals: [role::35046358490550272]
}

model.conf

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _
g2 = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub) && g2(r.obj, p.obj) && r.act == p.act
hsluoyz commented 2 years ago

@fabian4

hsluoyz commented 2 years ago

@mlsen

mlsen commented 2 years ago

Hi,

not really maintaining this since I'm not using Casbin anymore but I'll look into it on the weekend if I have some time.

mlsen commented 2 years ago

Thanks!