Eh2406 opened a new issue, #425: URL: https://github.com/apache/casbin-rs/issues/425
Hi, I am Co-Lead of the Rust Cargo Team and was recently hired by the Rust Foundation to help triage AI discovered bugs. This bug was found with AI, namely scrutineer and Fable. Except where specifically labeled this report was written by me. I am posting this as a public issue as I have not received a response to our attempts to reach out on https://security.apache.org/report-code/, by email, and on your discord. From the AI: > Casbin-rs gives every grouping assertion (g, g2, and other g* definitions) the same role manager, so a membership written to one resource-grouping namespace is also honored by all others. > > ```rust > #[tokio::test] > async fn test_grouping_role_managers_are_isolated() { > let m = DefaultModel::from_str( > r#" > [request_definition] > r = sub, obj, act > > [policy_definition] > p = sub, obj, act > > [role_definition] > g = _, _ > g2 = _, _ > > [policy_effect] > e = some(where (p.eft == allow)) > > [matchers] > m = g(r.sub, p.sub) && g2(r.obj, p.obj) && r.act == p.act > "#, > ) > .await > .unwrap(); > let adapter = StringAdapter::new( > r#" > p, admin, data_group, write > g, alice, admin > g2, report1, data_group > # Deliberately put eve under admin ONLY in g2 to test relation isolation. > # Names are strings: this must not create g, eve, admin or grant a user role. > g2, eve, admin > "#, > ); > let mut e = Enforcer::new(m, adapter).await.unwrap(); > e.enable_auto_save(false); > > > assert!(e.enforce(("alice", "report1", "write")).unwrap()); > assert!(!e.enforce(("eve", "data_group", "write")).unwrap()); > assert!(!e.has_role_for_user("eve", "admin", None)); > > e.add_named_grouping_policy("g2", vec!["mallory".to_owned(), "admin".to_owned()]) > .await > .unwrap(); > > assert!(!e.enforce(("mallory", "data_group", "write")).unwrap()); > assert!(!e.has_role_for_user("mallory", "admin", None)); > } > ``` > > -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
