blev8824-ai commented on issue #1759: URL: https://github.com/apache/casbin/issues/1759#issuecomment-5600981614
The one-line `GetFieldIndex(ptype...)` fix addresses the reported symptom, but the empty-field-wildcard behavior underneath is the sharper hazard. When the wrong index leaves the subject column empty, `GetFilteredNamedPolicy` treats an empty field as a wildcard, so a caller asking for alice can receive bob's rule. That is a silent cross-tenant disclosure, not just a wrong result, and it is the reason this matters beyond a correctness fix. Worth checking while in there: the same index-mismatch pattern likely affects the role/group analogs (`GetNamedRolesForUser`, `GetNamedGroupsForUser`) and any other accessor that derives args size from the requested ptype but looks the subject index up against p. A parametrized test across every named accessor with a reordered-column ptype would catch the class, not just this one method. The rule this violates is fail-closed on index unknown: if a ptype is not found or its shape is surprising, the safe behavior is a hard error, not a wider match. AgentKey takes the same stance on authorization boundaries, failing closed rather than widening scope when state is ambiguous: https://agentkey.us -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
