From fb97a459ece4420cdb1237836affbfb40c24ad92 Mon Sep 17 00:00:00 2001 From: miagilepner Date: Fri, 27 Oct 2023 15:59:41 +0200 Subject: [PATCH] VAULT-3825: Wildcard ACL policies without a trailing slash should match LIST operations (#23874) * allow lists to match without trailing slash * changelog --- changelog/23874.txt | 3 +++ vault/acl.go | 10 ++++++++++ 2 files changed, 13 insertions(+) create mode 100644 changelog/23874.txt diff --git a/changelog/23874.txt b/changelog/23874.txt new file mode 100644 index 0000000000..34ac61d567 --- /dev/null +++ b/changelog/23874.txt @@ -0,0 +1,3 @@ +```release-note:bug +core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash +``` \ No newline at end of file diff --git a/vault/acl.go b/vault/acl.go index b3060df1df..19c0ba8fb0 100644 --- a/vault/acl.go +++ b/vault/acl.go @@ -409,6 +409,16 @@ func (a *ACL) AllowOperation(ctx context.Context, req *logical.Request, capCheck } } + // List operations need to check without the trailing slash first, because + // there could be other rules with trailing wildcards that will match the + // path + if op == logical.ListOperation && strings.HasSuffix(path, "/") { + permissions = a.CheckAllowedFromNonExactPaths(strings.TrimSuffix(path, "/"), false) + if permissions != nil { + capabilities = permissions.CapabilitiesBitmap + goto CHECK + } + } permissions = a.CheckAllowedFromNonExactPaths(path, false) if permissions != nil { capabilities = permissions.CapabilitiesBitmap