NUAAwqy opened a new pull request, #1771:
URL: https://github.com/apache/casbin/pull/1771
## Problem
`util.IPMatch` panics when either argument is not a valid IP address / CIDR:
```go
panic("invalid argument: ip1 in IPMatch() function is not an IP address.")
```
Two consequences:
1. Inside a matcher (`m = ipMatch(r.ip, p.ip)`), a user-supplied request
value such as `192.168.1.abc` makes `Enforce` return `panic: invalid argument:
...` with a full `debug.Stack()` dump instead of a clean error.
2. Direct callers of the public `util.IPMatch` helper crash the process.
Every sibling operator already follows the convention documented on
`RegexMatch`:
> An invalid pattern matches nothing; RegexMatchFunc reports it as an error.
`GlobMatchFunc` likewise propagates the glob error. `IPMatch` is the only
operator in the package that panics (verified: the two `panic()` calls in
`util` are both in `IPMatch`).
## Fix
- Extract the parsing logic into an internal `ipMatch(ip1, ip2) (bool,
error)`.
- Public `IPMatch` keeps its `bool` signature, no longer panics, and returns
`false` on invalid input — same semantics as `RegexMatch` returning `false` for
an invalid pattern.
- `IPMatchFunc` returns `ipMatch: <detail>` as an error, matching
`RegexMatchFunc` / `GlobMatchFunc`.
## Tests
Added `TestIPMatchInvalidInput`:
- `IPMatch("192.168.1.abc", "192.168.1.0/24")` → `false` (was a panic)
- `IPMatch("192.168.2.123", "not-an-ip")` → `false` (was a panic)
- `IPMatchFunc` on both inputs returns `ipMatch: invalid argument: ...`
Full `go build ./...` and `go test ./util/ .` pass.
Before: `Enforce` error was `panic: invalid argument: ip1 in IPMatch()
function is not an IP address.
<stack trace>`
After: `Enforce` error is `ipMatch: invalid argument: ip1 in IPMatch()
function is not an IP address.`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
