fix(permissions): add a check for empty glob paths by victorvhs017 · Pull Request #5415 · Infisical/infisical

victorvhs017 · 2026-02-10T15:38:30Z

Context

If the service token has an empty path, it would cause an error in the glob processor.

Added a check in the CASL index to prevent empty glob paths from being processed.
Added a simple validation to prevent empty secretPaths in the UI

Screenshots

Steps to verify the change

Create a Service Token with an empty Secrets Path and try to call the secrets endpoints with that token.

You'll have to update the path in the db because we are blocking this in the UI now
If you have an empty path, it will return nothing "{"secrets":[],"imports":[]}%"
If you have a non-empty path, it will do the query

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Read the contributing guide

Updated the project-permission service to consolidate permission conditions into a single object, improving readability and maintainability. Additionally, added a check in the CASL index to prevent empty glob paths from being processed.

maidul98 · 2026-02-10T15:39:28Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-02-10T15:43:08Z

Greptile Overview

Greptile Summary

This PR prevents empty glob patterns from being evaluated in CASL’s $glob matcher, and adds UI validation to block creating service token scopes with an empty secretPath.

The backend change lives in the CASL condition interpreter used for permission rule evaluation, while the frontend change updates the service token creation modal’s zod schema and small layout tweaks for the scopes form.

Confidence Score: 4/5

Mostly safe to merge once the frontend scope default is fixed
Backend change is narrowly-scoped and reduces error risk in glob evaluation. Main concern is the frontend now appends an invalid empty secretPath, which can regress the service token creation flow/UX and cause failed submissions.
frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/AddServiceTokenModal.tsx

Important Files Changed

Filename	Overview
backend/src/lib/casl/index.ts	Adds a guard to treat empty $glob patterns as non-matching before calling picomatch.
frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/AddServiceTokenModal.tsx	Adds zod min(1) validation for secretPath and tweaks layout; introduces a default empty secretPath when adding new scope, which will always fail validation.

greptile-apps

_{2 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

backend/src/ee/services/permission/project-permission.ts

Added validation to ensure the secret path is not empty in the AddServiceTokenModal. Adjusted layout styles for better alignment of token scopes in the form, improving user experience.

victorvhs017 · 2026-02-10T16:15:58Z

@greptileai re-review and update the summary

greptile-apps

_{2 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

backend/src/lib/casl/index.ts

greptile-apps · 2026-02-10T16:23:28Z

Additional Comments (1)

frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/AddServiceTokenModal.tsx
New scope starts invalid

The new zod constraint (secretPath.min(1)) makes an empty string invalid, but the “Add Scope” button appends secretPath: "" (AddServiceTokenModal.tsx:210-214). This means every newly-added scope will immediately fail validation until the user types something, which is a regression in UX and can block submit if the user forgets to fill it. Appending the same default used elsewhere (e.g. "/") avoids creating an invalid form state by default.

Updated the AddServiceTokenModal to set a default secret path of "/" instead of an empty string. Additionally, modified the CASL index to trim whitespace from permission glob paths, preventing empty values from being processed.

victorvhs017 requested a review from akhilmhdh February 10, 2026 15:38

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

backend/src/ee/services/permission/project-permission.ts Outdated Show resolved Hide resolved

feat: enhance service token modal validation and layout

c50e637

Added validation to ensure the secret path is not empty in the AddServiceTokenModal. Adjusted layout styles for better alignment of token scopes in the form, improving user experience.

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

backend/src/lib/casl/index.ts Show resolved Hide resolved

fix: ensure secret path validation in service token modal

99f5acd

Updated the AddServiceTokenModal to set a default secret path of "/" instead of an empty string. Additionally, modified the CASL index to trim whitespace from permission glob paths, preventing empty values from being processed.

akhilmhdh approved these changes Feb 10, 2026

View reviewed changes

victorvhs017 merged commit e916454 into main Feb 10, 2026
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(permissions): add a check for empty glob paths#5415

fix(permissions): add a check for empty glob paths#5415
victorvhs017 merged 3 commits intomainfrom
fix/check-emprty-secretpath-for-service-token

victorvhs017 commented Feb 10, 2026 •

edited

Loading

Uh oh!

maidul98 commented Feb 10, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

victorvhs017 commented Feb 10, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

greptile-apps bot commented Feb 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

victorvhs017 commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Screenshots

Steps to verify the change

Type

Checklist

Uh oh!

maidul98 commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

victorvhs017 commented Feb 10, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps bot commented Feb 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

victorvhs017 commented Feb 10, 2026 •

edited

Loading

maidul98 commented Feb 10, 2026 •

edited

Loading

greptile-apps bot commented Feb 10, 2026 •

edited

Loading