From 87c65c2591224080f677b07f627b25e056878d01 Mon Sep 17 00:00:00 2001
From: Denis Arh <denis.arh@gmail.com>
Date: Thu, 14 Jul 2022 19:06:29 +0200
Subject: [PATCH] Fix RBAC tracing issue - handling wildcarded resources

---
 pkg/rbac/resource.go      |  4 ++--
 pkg/rbac/resource_test.go | 10 +++++-----
 pkg/rbac/service.go       |  5 +++++
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/pkg/rbac/resource.go b/pkg/rbac/resource.go
index 83afa2b41..cbfbe6064 100644
--- a/pkg/rbac/resource.go
+++ b/pkg/rbac/resource.go
@@ -64,10 +64,10 @@ func ResourceComponent(r string) string {
 	}
 }
 
+// match returns true if the given resource matches the given pattern
 func matchResource(matcher, resource string) (m bool) {
 	if matcher == resource {
-		// if resources match make sure no wildcards are resent
-		return !hasWildcards(resource)
+		return true
 	}
 
 	m, _ = path.Match(matcher, resource)
diff --git a/pkg/rbac/resource_test.go b/pkg/rbac/resource_test.go
index 479a27bc3..add5b5fa2 100644
--- a/pkg/rbac/resource_test.go
+++ b/pkg/rbac/resource_test.go
@@ -73,11 +73,11 @@ func TestResourceMatch(t *testing.T) {
 }
 
 //cpu: Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz
-//Benchmark_MatchResource100-16        	 7353837	       157.0 ns/op
-//Benchmark_MatchResource1000-16       	 6868928	       166.0 ns/op
-//Benchmark_MatchResource10000-16      	 7373701	       164.8 ns/op
-//Benchmark_MatchResource100000-16     	 7556944	       156.5 ns/op
-//Benchmark_MatchResource1000000-16    	 7445456	       157.8 ns/op
+//Benchmark_MatchResource100-16        	 6527383	       183.2 ns/op
+//Benchmark_MatchResource1000-16       	 6335626	       183.5 ns/op
+//Benchmark_MatchResource10000-16      	 6565214	       183.5 ns/op
+//Benchmark_MatchResource100000-16     	 6541002	       183.7 ns/op
+//Benchmark_MatchResource1000000-16    	 6542052	       183.5 ns/op
 func benchmarkMatchResource(b *testing.B, c int) {
 	b.StartTimer()
 
diff --git a/pkg/rbac/service.go b/pkg/rbac/service.go
index f3da56bd7..c42a7cf2e 100644
--- a/pkg/rbac/service.go
+++ b/pkg/rbac/service.go
@@ -97,6 +97,11 @@ func (svc *service) Check(ses Session, op string, res Resource) (a Access) {
 		fRoles = getContextRoles(ses, res, svc.roles)
 	)
 
+	if hasWildcards(res.RbacResource()) {
+		// prevent use of wildcard resources for checking permissions
+		return Inherit
+	}
+
 	a = check(svc.indexed, fRoles, op, res.RbacResource(), nil)
 
 	svc.logger.Debug(a.String()+" "+op+" for "+res.RbacResource(),