lenamonj opened a new issue, #1752:
URL: https://github.com/apache/casbin/issues/1752
`util.SetEquals`, `util.SetEqualsInt` and `util.Set2DEquals` call
`sort.Strings` / `sort.Ints` / `sort.Sort` directly on both arguments. They are
comparison helpers, so callers reasonably treat them as read-only, but any
caller that passes a slice it does not own gets that slice reordered in place.
The sharpest consequence: `Enforcer.GetPermissionsForUser` returns the
model's live policy rows. Passing its result to `Set2DEquals` sorts each stored
rule's fields in place, so a rule like `p, zoe, data1, read` becomes `data1,
read, zoe` inside the model, and a request that was allowed before the
comparison is denied after it.
Reproduction against master (34297a1):
```go
a := stringadapter.NewAdapter("p, zoe, data1, read")
e, _ := casbin.NewEnforcer(m, a)
before, _ := e.Enforce("zoe", "data1", "read")
fmt.Println("enforce before:", before)
perms, _ := e.GetPermissionsForUser("zoe")
util.Set2DEquals(perms, [][]string{{"zoe", "data1", "read"}})
policy, _ := e.GetPolicy()
fmt.Println("stored policy after comparison:", policy)
after, _ := e.Enforce("zoe", "data1", "read")
fmt.Println("enforce after:", after)
```
Output:
```
enforce before: true
stored policy after comparison: [[data1 read zoe]]
enforce after: false
```
The fix is small: sort copies instead of the arguments (and for
`Set2DEquals`, copies of the inner rows as well, since sorting a row's fields
is the mutation that corrupts a policy rule). I have it ready with a regression
test and will open a PR referencing this issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
