Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

`EscapeAssertion` rewrites a nested attribute dot when the request/policy field name contains an underscore

Abierto Apto para principiantes
  • ¿Algo no está bien?
#277 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
92/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
cpp
Área
security

Línea de trabajo

Comienza con EscapeAssertion en casbin/util/escape_assertion.cpp y su declaración en include/casbin/util/util.h. Ejecuta el test existente TestEscapeAssertion en tests/util_test.cpp y luego añade un caso que cubra r.sub_data.attr.id; el resultado esperado debe conservar los puntos de los atributos anidados y escapar solo los separadores r. y p.. Confirma que los tests existentes de utilidades y de aplicación de políticas siguen pasando.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Location (apache/casbin-cpp @ default branch 0ad64a7):

std::string EscapeAssertion(std::string s) {
    std::regex regex_s("[a-zA-Z0-9. ]+");

    std::sregex_iterator words_begin = std::sregex_iterator(s.begin(), s.end(), regex_s);
    auto words_end = std::sregex_iterator();

    for (std::sregex_iterator k = words_begin; k != words_end; ++k) {
        std::smatch match = *k;
        std::string match_str = match.str();
        int pos = static_cast<int>(match_str.find("."));
        if (pos != -1) {
            std::string new_str = match_str.replace(pos, 1, "_");
            s = s.replace(match.position(), match.str().length(), new_str);
        }
    }

    return s;
}

Problem

casbin::EscapeAssertion("r.sub_data.attr.id == p.sub && r.act == p.act");
// actual:   "r_sub_data_attr.id == p_sub && r_act == p_act"
// expected: "r_sub_data.attr.id == p_sub && r_act == p_act"

The function tokenizes with [a-zA-Z0-9. ]+, which doesn't include _. In r.sub_data.attr.id the underscore ends the first match (r.sub), and data.attr.id becomes a second match whose first dot is replaced. Only the r. / p. separator should become _; the attribute path .attr.id should be left alone, which is what already happens for names without underscores: tests/util_test.cpp expects r.attr.value == p.attr → r_attr.value == p_attr.

Scope: EscapeAssertion is declared in the public header include/casbin/util/util.h (included by casbin/casbin.h), documented as taking "the value of the matcher and effect assertions". In the current Enforce path it is only applied to the argument names of eval(...) (casbin/enforcer.cpp:120-124), so this is not an enforcement failure: Enforce results are not affected. This is about the result of the public utility for code that calls it directly (model tooling, converters).

Reproduction
Verbatim gtest output for the call above:

Expected equality of these values:
  my_res
    Which is: "r_sub_data_attr.id == p_sub && r_act == p_act"
  res
    Which is: "r_sub_data.attr.id == p_sub && r_act == p_act"

Environment:

  • Commit: 0ad64a7 (master)
  • Toolchain: GCC 11.5.0

Already fixed in apache/casbin-node-casbin
PR: https://github.com/apache/casbin-node-casbin/pull/394 — "fix: escape assersion bug" (merged 2022-10-04T14:04:04Z, merge commit 5a339d858a9). node-casbin's escapeAssertion also rewrote dots inside the nested attribute path of r.sub_data.attr.id (its old regex replaced every r. / p., including the one at the end of attr.). The fix only rewrites r. / p. when preceded by a space or (, i.e. at the start of an identifier, and the added example model uses the same matcher as above. In node-casbin the helper is on the enforcement path, so the bug there also changed Enforce results; in casbin-cpp only the public helper's output is affected.

How node-casbin fixed it:

--- a/src/util/util.ts
+++ b/src/util/util.ts
@@ -17,8 +17,10 @@ import * as fs from 'fs';
 // escapeAssertion escapes the dots in the assertion,
 // because the expression evaluation doesn't support such variable names.
 function escapeAssertion(s: string): string {
-  s = s.replace(/r\./g, 'r_');
-  s = s.replace(/p\./g, 'p_');
+  s = ' ' + s;
+  s = s.replace(/(?<=[\(| ])r\./g, 'r_');
+  s = s.replace(/(?<=[\(| ])p\./g, 'p_');
+  s = s.trim();
   return s;
 }
 
--- a/examples/abac_attr_model.conf
+++ b/examples/abac_attr_model.conf
@@ -0,0 +1,11 @@
+[request_definition]
+r = sub_data, act
+
+[policy_definition]
+p = sub, act
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = r.sub_data.attr.id == p.sub && r.act == p.act
\ No newline at end of file

Suggested fix
Rewrite only the dot right after an r/p token (optionally numbered) that starts at an identifier boundary, as node-casbin anchors its replacement, so the rest of the attribute path is kept:

diff --git a/casbin/util/escape_assertion.cpp b/casbin/util/escape_assertion.cpp
--- a/casbin/util/escape_assertion.cpp
+++ b/casbin/util/escape_assertion.cpp
@@ -32,22 +32,9 @@ namespace casbin {
  * @return the escaped value.
  */
 std::string EscapeAssertion(std::string s) {
-    std::regex regex_s("[a-zA-Z0-9. ]+");
-
-    std::sregex_iterator words_begin = std::sregex_iterator(s.begin(), s.end(), regex_s);
-    auto words_end = std::sregex_iterator();
-
-    for (std::sregex_iterator k = words_begin; k != words_end; ++k) {
-        std::smatch match = *k;
-        std::string match_str = match.str();
-        int pos = static_cast<int>(match_str.find("."));
-        if (pos != -1) {
-            std::string new_str = match_str.replace(pos, 1, "_");
-            s = s.replace(match.position(), match.str().length(), new_str);
-        }
-    }
-
-    return s;
+    // Only the dot right after an r/p token (e.g. r., p., r2.) is escaped; the token must start at an identifier boundary.
+    static const std::regex regex_s("(^|[^A-Za-z0-9_])([rp][0-9]*)\\.");
+    return std::regex_replace(s, regex_s, "$1$2_");
 }
 
 } // namespace casbin

Verified on 0ad64a7 (GCC 11.4.0, GoogleTest 1.14.0): with the example above added to TestEscapeAssertion in tests/util_test.cpp, the test fails without this patch and passes with it; no other test results change, including the existing TestEscapeAssertion cases.

I can submit a PR for this.

Related: searched issues/PRs (all states) for underscore, ABAC attribute dot, escape assertion: no hits. Dots inside quoted string literals are a separate problem with a different cause and are reported separately.

Lenguaje dominante
C++
Estrellas
257
Forks
66
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/casbin-cpp

Todos los issues de apache/casbin-cpp

Issues similares

Más issues de C++

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.