GetFilteredPolicy treats "" as a wildcard (matches any value), making it impossible to query for policy rules where a field is literally an empty string. The issue requests a non-breaking strict variant.

Changes

• model/policy.go — Added GetStrictFilteredPolicy core method: "" matches only empty-string fields, "*" matches any value. Includes bounds check on fieldIndex+i absent from the original.
• management_api.go — Added four new Enforcer methods: GetStrictFilteredPolicy, GetStrictFilteredNamedPolicy, GetStrictFilteredGroupingPolicy, GetStrictFilteredNamedGroupingPolicy
• enforcer_interface.go — Extended IEnforcer with the four new methods
• enforcer_synced.go — Added thread-safe wrappers on SyncedEnforcer for all four methods

Behaviour contrast

// Policy contains: ["alice","data1","read"], ["","data1","read"]

// Old: "" is wildcard — returns both rules
e.GetFilteredPolicy(0, "")           // [["alice","data1","read"], ["","data1","read"]]

// New: "" is literal — returns only the empty-subject rule
e.GetStrictFilteredPolicy(0, "")     // [["","data1","read"]]

// New: "*" is wildcard — returns all rules
e.GetStrictFilteredPolicy(0, "*")    // [["alice","data1","read"], ["","data1","read"]]

• Fixes e.GetFilteredPolicy Empty string treated as wildcard #1708

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.