Eh2406 opened a new issue, #427: URL: https://github.com/apache/casbin-rs/issues/427
Hi, I am Co-Lead of the Rust Cargo Team and was recently hired by the Rust Foundation to help triage AI discovered bugs. This bug was found with AI, namely scrutineer and Fable. Except where specifically labeled this report was written by me. I am posting this as a public issue as I have not received a response to our attempts to reach out on https://security.apache.org/report-code/, by email, and on your discord. From the AI: > ## Summary > > Retained role grants bypass wildcard-domain revocation. When pattern-domain matching is enabled, `DefaultRoleManager` physically copies wildcard-domain role edges into matching concrete-domain graphs, but `delete_link` removes only the edge in the named domain. A successful grouping-policy revocation can therefore leave copied grants active with no corresponding policy row. > > ## Impact > > An authenticated user whose wildcard-domain role is revoked can continue to access resources in concrete domains where the grant was copied. The revocation API reports success and the grouping-policy row disappears, so the retained authorization is silent; a later full role-link rebuild or process restart clears the stale edge. > > ## Proof of concept > > Create `tests/poc.rs` in a project using an affected `casbin` release: > > ```rust > use casbin::function_map::key_match; > use casbin::{DefaultRoleManager, RoleManager}; > > #[test] > fn wildcard_domain_grant_survives_revocation() { > let mut role_manager = DefaultRoleManager::new(10); > role_manager.matching_fn(None, Some(key_match)); > > role_manager.add_link("alice", "admin", Some("*")); > role_manager.add_link("bob", "admin", Some("domain2")); > assert!(role_manager.has_link("alice", "admin", Some("domain2"))); > > role_manager > .delete_link("alice", "admin", Some("*")) > .unwrap(); > > assert!(role_manager.has_link("alice", "admin", Some("domain2"))); > } > ``` > > The test passes on affected versions because `alice -> admin` remains in the `domain2` graph after the wildcard-domain link is deleted. The verified end-to-end reproducer also observed `remove_grouping_policy(...) == true`, an empty corresponding policy row, and `enforce(...) == true` for the copied domain grant. The AI reports, but I have not had a chance to investigate, the same issue being present in the Go implementation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
