Eh2406 opened a new issue, #424: URL: https://github.com/apache/casbin-rs/issues/424
Hi, I am Co-Lead of the Rust Cargo Team and was recently hired by the Rust Foundation to help triage AI discovered bugs. This bug was found with AI, namely scrutineer and Fable. Except where specifically labeled this report was written by me. I am posting this as a public issue as I have not received a response to our attempts to reach out on https://security.apache.org/report-code/, by email, and on your discord. https://github.com/apache/casbin-rs/blob/master/src/model/function_map.rs#L204 Panics if either of the strings have a multi by unicode character at `i`. The point of casbin is to validate untrusted user authentications. Any user of uses `key_get` will crash with one of `éééééééééé` or `aéééééééééé`. From the AI: > `i` is a byte offset derived from key2, then used to slice key1. The two strings are unrelated, so nothing makes i a UTF-8 character boundary in `key1`. Rust's `str` index panics rather than truncating. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
