diff --git a/changelog/23874.txt b/changelog/23874.txt new file mode 100644 index 0000000000..34ac61d567 --- /dev/null +++ b/changelog/23874.txt @@ -0,0 +1,3 @@ +```release-note:bug +core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash +``` \ No newline at end of file diff --git a/vault/acl.go b/vault/acl.go index b3060df1df..19c0ba8fb0 100644 --- a/vault/acl.go +++ b/vault/acl.go @@ -409,6 +409,16 @@ func (a *ACL) AllowOperation(ctx context.Context, req *logical.Request, capCheck } } + // List operations need to check without the trailing slash first, because + // there could be other rules with trailing wildcards that will match the + // path + if op == logical.ListOperation && strings.HasSuffix(path, "/") { + permissions = a.CheckAllowedFromNonExactPaths(strings.TrimSuffix(path, "/"), false) + if permissions != nil { + capabilities = permissions.CapabilitiesBitmap + goto CHECK + } + } permissions = a.CheckAllowedFromNonExactPaths(path, false) if permissions != nil { capabilities = permissions.CapabilitiesBitmap