This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin.git
The following commit(s) were added to refs/heads/master by this push:
new aa1ef64 fix: reject policy fields with line breaks in PolicyLineToCsv
aa1ef64 is described below
commit aa1ef64c8bf1fe5884c226a5dd633011e1f0eaa5
Author: Yang Luo <[email protected]>
AuthorDate: Sat Oct 31 09:04:05 2026 +0800
fix: reject policy fields with line breaks in PolicyLineToCsv
---
persist/adapter.go | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/persist/adapter.go b/persist/adapter.go
index e0d91cd..c5ec15c 100644
--- a/persist/adapter.go
+++ b/persist/adapter.go
@@ -21,6 +21,7 @@ import (
"bytes"
"encoding/csv"
"errors"
+ "fmt"
"strings"
"github.com/casbin/casbin/v3/model"
@@ -49,7 +50,8 @@ func LoadPolicyLine(line string, m model.Model) error {
// Fields are separated by ", " to match the conventional layout of Casbin
policy
// files, which LoadPolicyLine accepts because its reader trims leading spaces.
// Fields containing commas are properly quoted so the line can be
round-tripped
-// through LoadPolicyLine without corruption.
+// through LoadPolicyLine without corruption. Fields containing a line break
are
+// rejected, because policy lines are loaded one physical line at a time.
func PolicyLineToCsv(ptype string, rule []string) (string, error) {
record := append([]string{ptype}, rule...)
@@ -59,6 +61,10 @@ func PolicyLineToCsv(ptype string, rule []string) (string,
error) {
w := csv.NewWriter(&buf)
fields := make([]string, 0, len(record))
for _, field := range record {
+ if strings.Contains(field, "\n") {
+ return "", fmt.Errorf("invalid policy field %q: line
breaks are not allowed", field)
+ }
+
buf.Reset()
if err := w.Write([]string{field}); err != nil {
return "", err
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
