Eh2406 commented on issue #426:
URL: https://github.com/apache/casbin-rs/issues/426#issuecomment-5878409285
I have a separate finding that I think has the same root cause.
> ## Summary
>
> Batch role revocation can leave revoked roles authorizing. A
self-referential grouping row is ignored when links are added but rejected when
links are deleted. During an incremental batch revocation, that error occurs
after policy rows have been removed and aborts unlinking later rules, leaving
the policy model and role graph inconsistent.
>
> ## Impact
>
> An authenticated, lower-privileged user who can create or edit grouping
policies can plant an inert self-referential row. If an administrator later
includes that row before a real grant in a batch revocation and the application
does not reload the complete policy after the error, the later role remains
active even though its policy row is gone; retries no-op, so a revoked
administrative role can continue authorizing access.
>
> ## Proof of concept
>
> Using the crate's shipped RBAC model and policy, add a self-referential
grouping row and then revoke it before a real role assignment in one batch:
>
> ```rust
> #[tokio::test]
> async fn batch_revocation_leaves_role_active() {
> use casbin::prelude::*;
>
> let mut enforcer = Enforcer::new(
> "examples/rbac_model.conf",
> "examples/rbac_policy.csv",
> )
> .await
> .unwrap();
>
> enforcer
> .add_grouping_policy(vec!["mallory".into(), "mallory".into()])
> .await
> .unwrap();
>
> let result = enforcer
> .remove_grouping_policies(vec![
> vec!["mallory".into(), "mallory".into()],
> vec!["alice".into(), "data2_admin".into()],
> ])
> .await;
>
> println!("remove_grouping_policies -> {result:?}");
> println!("g = {:?}", enforcer.get_grouping_policy());
> println!("roles = {:?}", enforcer.get_roles_for_user("alice", None));
> println!(
> "allowed = {:?}",
> enforcer.enforce(("alice", "data2", "read"))
> );
> }
> ```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
