keyMatch() matches unwanted policies

[casbin]

keyMatch() matches unwanted policies

[nodece]

YES. It is match all policy.

[hsluoyz]

Hi @Jarvie8176 , node-casbin internally uses expression-eval to evaluate the matcher. Probably it doesn't support short-circuit. If you want this feature, you can ask this in their repo's issues.

[Jarvie8176]

Hi @Jarvie8176 , node-casbin internally uses expression-eval to evaluate the matcher. Probably it doesn't support short-circuit. If you want this feature, you can ask this in their repo's issues.

Do you mean keyMatch() should match all policies in this case?

[nodece]

Casbin need call policy_effect determines the return value after match all polices.

[Jarvie8176]

The test would pass if I used regexMatch() instead of keyMatch(). I think my question is what should keyMatch("alice:res1:A", "alice:*:B") return?

[hsluoyz]

Hi @Jarvie8176 , keyMatch("alice:res1:A", "alice:*:B") should return false. See:

https://github.com/casbin/casbin/blob/9814ac94c19c922c0afd5c2f34255e0d543ef372/util/builtin_operators.go#L25-L37

[Jarvie8176]

I wrote a failing test here: Jarvie8176@d66e4a1

It looks like keyMatch()'s precondition is that the wildcard, if exists, should be the last character in key2 but that is not satisfied in this case. To match wildcard properly you may have to implement a DP algorithm. Would you consider using utility libraries (e.g. matcher or minimatch) to offload complexity?

[nodece]

@Jarvie8176 Looking good, our team needs to discuss.

[hsluoyz]

@Jarvie8176 keyMatch() assumes that * is the last character of the string. It is not designed to handle cases like alice:*:B. Please use regexMatch() for your scenario. You can add your own custom function to Casbin too.