mirrors
/
redis
mirror of https://mirror.osredm.com/root/redis.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

modules API: Add test for ACL check of empty prefix (#13678) 

- Add empty string test for the new API
`RedisModule_ACLCheckKeyPrefixPermissions`.
- Fix order of checks: `(pattern[patternLen - 1] != '*' || patternLen ==
0)`

---------

Co-authored-by: debing.sun <debing.sun@redis.com>
This commit is contained in:
Moti Cohen 2024-12-10 09:16:30 +02:00 committed by GitHub
parent 0dd057222b
commit c51c96656b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/util.c
View File

@ -217,7 +217,7 @@ int prefixmatch(const char *pattern, int patternLen,
* it can match any suffix of the string beyond the prefix. This check
* remains outside stringmatchlen_impl() to keep its complexity manageable.
*/
if (pattern[patternLen - 1] != '*' || patternLen == 0)
if (patternLen == 0 || pattern[patternLen - 1] != '*' )
return 0;
/* Count backward the number of consecutive backslashes preceding the '*'

15
tests/unit/moduleapi/aclcheck.tcl
View File

@ -50,7 +50,20 @@ start_server {tags {"modules acl"}} {
catch {r aclcheck.set.check.prefixkey "~" ESCAPED_STAR* ESCAPED_STAR* 5} e
assert_match "*DENIED KEY*" $e
assert_equal [r aclcheck.set.check.prefixkey "~" NON_ESCAPED_STAR\\ NON_ESCAPED_STAR\\clothes 5] OK
}
}
test {check ACL permissions versus empty string prefix} {
# The empty string should should match all keys permissions
r acl setuser default +set resetkeys %R~* %W~* ~*
assert_equal [r aclcheck.set.check.prefixkey "~" "" CART_BOOKS_12 5] OK
assert_equal [r aclcheck.set.check.prefixkey "W" "" ORDER_2024_564879 5] OK
assert_equal [r aclcheck.set.check.prefixkey "R" "" PRODUCT_BOOKS_753376 5] OK
# The empty string prefix should not match if cannot access all keys
r acl setuser default +set resetkeys %R~x* %W~x* ~x*
catch {r aclcheck.set.check.prefixkey "~" "" CART_BOOKS_12 5} e
assert_match "*DENIED KEY*" $e
}
test {test module check acl for key perm} {
# give permission for SET and block all keys but x(READ+WRITE), y(WRITE), z(READ)