tisonkun opened a new pull request, #538: URL: https://github.com/apache/casbin-jcasbin/pull/538
Resource `keyMatch(r.obj, p.obj)` could unintentionally enable wildcard role domains when the domain field appeared elsewhere in the model. Infer domain matching from the request field actually passed as the third argument of the named role function, ignoring quoted text and respecting nested arguments. Rebuilding conditional domain managers could propagate role links without their condition functions and parameters, allowing requests despite a rejecting condition. Restore complete domain managers first, then propagate complete links from the original snapshot. Add enforcement regressions for exact domain isolation, explicit and inferred domain matching, custom domain fields and named roles, quoted matcher text, and conditional checks across existing/lazy domains, repeated rebuilds, and parameter updates. Validation: - Reproduced both authorization failures before the fix; all five regression cases pass afterward. - Java 8 (Zulu 8u482), Maven 3.9.12: `mvn -B -ntp clean verify cobertura:cobertura -Papache-release -Drevision=1.100.0 -Dgpg.skip=true`, with `CASBIN_CONFORMANCE_DIR` from `apache/casbin@c35c93d29063b8bc3bc2ef30b09943d344a289f4`. - 345 tests, zero failures/errors/skips, including conformance. - All 11 release-verification Python tests pass. - Apache RAT 0.18 passes with Java 25. Cobertura emits Java 8 source-parser diagnostics while calculating complexity; the unmodified RC4 baseline produces the same 28 diagnostics. Both commands exit successfully and generate coverage reports. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
