Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Policy with root-level wildcard resource isn't being honored when forward slash is used #18

Closed
jasonatepaint opened this issue Apr 29, 2020 · 1 comment
Labels
bug Something isn't working

Comments

@jasonatepaint
Copy link

jasonatepaint commented Apr 29, 2020

It's unclear from the examples and the source code tests if paths with a forward slash should honor a wildcard.

Example of a super user (AWS IAM administrator access)

const allowExample = new IdentityBasedPolicy([
       {
		effect: 'allow',
		action: ['*'],
		resource: ['*'],
	}
]);

can = allowExample.evaluate({
	action: 'read',
	resource: 'org:123:999/image'
});

//returns false

The only way to make the above statement to be true is to add an additional wildcard resource with the pathing:

const allowExample = new IdentityBasedPolicy([
	{
		effect: 'allow',
		action: ['*'],
		resource: ['*', '*/*' ],
	}
]);

//returns true

This would require those additional wildcard resources are added anytime another level of pathing is added to a resource.

Is there a reason for the special handling of the forward slash? It would seem a root-level wildcard of * should allow all resources, regardless of path.

Thanks!

@roggervalf
Copy link
Owner

roggervalf commented Apr 30, 2020

Hi @jasonatepaint, thanks for notice this, already fix it and add your example. Let try the new release.

roggervalf pushed a commit that referenced this issue Apr 30, 2020
## [3.0.5](v3.0.4...v3.0.5) (2020-04-30)

### Bug Fixes

* **matcher:** allow passing / into string comparison for * ([94da308](94da308)), closes [#18](#18)
@roggervalf roggervalf added the bug Something isn't working label Jul 20, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants