(casbin-rs) branch master updated: fix: don't rewrite r. and p. inside string literals in escape_assertion

[hs...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin-rs.git


The following commit(s) were added to refs/heads/master by this push:
     new d24d16b  fix: don't rewrite r. and p. inside string literals in escape_assertion
d24d16b is described below

commit d24d16b0f038f5126b116559e75940e945561957
Author: Yang Luo <hs...@gmail.com>
AuthorDate: Tue Oct 20 22:29:58 2026 +0800

    fix: don't rewrite r. and p. inside string literals in escape_assertion
---
 src/util.rs | 37 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/src/util.rs b/src/util.rs
index f830a9f..24cab15 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -19,7 +19,31 @@ pub(crate) static ESC_E: Lazy<Regex> =
     Lazy::new(|| regex!(r"\beval\(([^)]*)\)"));
 
 pub fn escape_assertion(s: &str) -> String {
-    ESC_A.replace_all(s, "${1}_").to_string()
+    let bytes = s.as_bytes();
+    let mut res = String::with_capacity(s.len());
+    let mut start = 0;
+    let mut i = 0;
+    while i < bytes.len() {
+        let quote = bytes[i];
+        if quote != b'"' && quote != b'\'' {
+            i += 1;
+            continue;
+        }
+        let mut end = i + 1;
+        while end < bytes.len() && bytes[end] != quote {
+            if bytes[end] == b'\\' {
+                end += 1;
+            }
+            end += 1;
+        }
+        let end = (end + 1).min(bytes.len());
+        res.push_str(&ESC_A.replace_all(&s[start..i], "${1}_"));
+        res.push_str(&s[i..end]);
+        start = end;
+        i = end;
+    }
+    res.push_str(&ESC_A.replace_all(&s[start..], "${1}_"));
+    res
 }
 
 pub fn remove_comment(s: &str) -> String {
@@ -85,6 +109,17 @@ mod tests {
         let exp1 = "g(r2_sub, p2_sub) && r2_obj == p2_obj && r2_act == p2_act";
 
         assert_eq!(exp1, escape_assertion(s1));
+
+        assert_eq!(
+            r#"r_sub == p_sub && r_obj == "https://p.example.com""#,
+            escape_assertion(
+                r#"r.sub == p.sub && r.obj == "https://p.example.com""#
+            )
+        );
+        assert_eq!(
+            r#"r_obj == "a\"p.b" || p_obj == 'r'"#,
+            escape_assertion(r#"r.obj == "a\"p.b" || p.obj == 'r'"#)
+        );
     }
 
     #[test]


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For additional commands, e-mail: commits-help@casbin.apache.org