This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin.git
The following commit(s) were added to refs/heads/master by this push:
new 9a5c253 fix: skip quoted literals when escaping r. and p. in matchers
9a5c253 is described below
commit 9a5c253a912120691d8c066631e0effafacd987f
Author: Yang Luo <[email protected]>
AuthorDate: Tue Oct 20 22:29:55 2026 +0800
fix: skip quoted literals when escaping r. and p. in matchers
---
util/util.go | 33 +++++++++++++++++++++++++++++++--
util/util_test.go | 3 +++
2 files changed, 34 insertions(+), 2 deletions(-)
diff --git a/util/util.go b/util/util.go
index 4311dcd..d508bfd 100644
--- a/util/util.go
+++ b/util/util.go
@@ -39,8 +39,38 @@ func JsonToMap(jsonStr string) (map[string]interface{},
error) {
}
// EscapeAssertion escapes the dots in the assertion, because the expression
evaluation doesn't support such variable names.
+// Quoted string literals are kept as they are.
func EscapeAssertion(s string) string {
- s = escapeAssertionRegex.ReplaceAllStringFunc(s, func(m string) string {
+ var b strings.Builder
+ start := 0
+ for i := 0; i < len(s); i++ {
+ quote := s[i]
+ if quote != '"' && quote != '\'' {
+ continue
+ }
+ end := i + 1
+ for end < len(s) && s[end] != quote {
+ if s[end] == '\\' {
+ end++
+ }
+ end++
+ }
+ if end < len(s) {
+ end++
+ } else {
+ end = len(s)
+ }
+ b.WriteString(escapeAssertionUnquoted(s[start:i]))
+ b.WriteString(s[i:end])
+ start = end
+ i = end - 1
+ }
+ b.WriteString(escapeAssertionUnquoted(s[start:]))
+ return b.String()
+}
+
+func escapeAssertionUnquoted(s string) string {
+ return escapeAssertionRegex.ReplaceAllStringFunc(s, func(m string)
string {
// Replace only the last dot with underscore (preserve the
prefix character)
lastDotIdx := strings.LastIndex(m, ".")
if lastDotIdx > 0 {
@@ -48,7 +78,6 @@ func EscapeAssertion(s string) string {
}
return m
})
- return s
}
// RemoveComments removes the comments starting with # in the text.
diff --git a/util/util_test.go b/util/util_test.go
index 45082b5..4f81133 100644
--- a/util/util_test.go
+++ b/util/util_test.go
@@ -53,6 +53,9 @@ func TestEscapeAssertion(t *testing.T) {
// Test that patterns inside strings are not escaped
testEscapeAssertion(t, `r.sub == "a.p.p.l.e"`, `r_sub == "a.p.p.l.e"`)
testEscapeAssertion(t, `r.sub == "test.p.value"`, `r_sub ==
"test.p.value"`)
+ testEscapeAssertion(t, `r.obj == "https://p.example.com"`, `r_obj ==
"https://p.example.com"`)
+ testEscapeAssertion(t, `r.obj == 'https://p.example.com' && p.sub ==
r.sub`, `r_obj == 'https://p.example.com' && p_sub == r_sub`)
+ testEscapeAssertion(t, `keyMatch(r.obj, "/p.*") || r.obj == "a\"/r.b"`,
`keyMatch(r_obj, "/p.*") || r_obj == "a\"/r.b"`)
}
func testRemoveComments(t *testing.T, s string, res string) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
