nikolauspschuetz opened a new pull request, #1746:
URL: https://github.com/apache/casbin/pull/1746
### What
`EscapeStringLiterals` iterated the matcher expression **byte-by-byte** and
re-encoded each byte as a rune:
```go
for i := 0; i < len(expr); i++ {
ch := rune(expr[i])
...
result.WriteRune(ch)
}
```
For any multi-byte UTF-8 character, every continuation byte (`0x80`–`0xFF`)
was written out as its own code point, corrupting the literal:
```
EscapeStringLiterals(`r.sub == '香港'`) => `r.sub == 'é¦\x99港'` // 17 ->
23 bytes
```
This runs at model-load time (`model.go` `loadAssertion`) and inside
`EnforceWithMatcher`, so a matcher containing a non-ASCII string literal
silently stopped matching the real request value — i.e. **wrong allow/deny
decisions** for any policy or matcher using non-ASCII literals.
### Fix
Iterate over runes (`for _, ch := range expr`) so multi-byte characters
round-trip unchanged. The backslash-doubling and quote-tracking logic is
unchanged. Added regression cases for CJK and accented literals to
`TestEscapeStringLiterals`.
`go test ./util/ -run TestEscapeStringLiterals` fails before this change
(the new cases) and passes after; the full `util` package tests pass, `go vet`
and `gofmt` are clean.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
