@@ -627,6 +627,26 @@ test('test ABAC single eval() with r. in unexpected places', async () => {
627627 await testEnforce ( e , { id : 3 } , ( { owner : { id : 2 } } as unknown ) as string , 'read' , false ) ;
628628} ) ;
629629
630+ test ( 'test escapeAssertion with string literals (issue)' , async ( ) => {
631+ // Test case from GitHub issue: escapeAssertion should not replace r./p. inside string literals
632+ const MY_RESOURCE_NAME = 'r.my_resource' ;
633+ const model = newModel ( ) ;
634+ model . addDef ( 'r' , 'r' , 'act, obj' ) ;
635+ model . addDef ( 'p' , 'p' , 'act, obj, rule' ) ;
636+ model . addDef ( 'e' , 'e' , 'some(where (p.eft == allow))' ) ;
637+ model . addDef ( 'm' , 'm' , 'r.act == p.act && r.obj == p.obj && eval(p.rule)' ) ;
638+
639+ const enforcer = await newEnforcer ( model ) ;
640+ enforcer . addPolicy ( 'alice' , MY_RESOURCE_NAME , `p.obj == "${ MY_RESOURCE_NAME } "` ) ;
641+
642+ // Should work because string literals are not escaped
643+ await expect ( enforcer . enforce ( 'alice' , MY_RESOURCE_NAME ) ) . resolves . toBe ( true ) ;
644+
645+ // Test with single quotes as well
646+ enforcer . addPolicy ( 'bob' , 'p.resource' , `p.obj == 'p.resource'` ) ;
647+ await expect ( enforcer . enforce ( 'bob' , 'p.resource' ) ) . resolves . toBe ( true ) ;
648+ } ) ;
649+
630650test ( 'TestEnforceSync' , async ( ) => {
631651 const m = newModel ( ) ;
632652 m . addDef ( 'r' , 'r' , 'sub, obj, act' ) ;
0 commit comments