lib/expression: fix policy request context pollution (#25462)

authentik/lib/expression/evaluator.py

@@ -2,6 +2,7 @@
 
 import re
 import socket
+from copy import deepcopy
 from ipaddress import ip_address, ip_network
 from smtplib import SMTPException
 from textwrap import indent
@@ -207,7 +208,7 @@ class BaseEvaluator:
         user = self._context.get("user", get_anonymous_user())
         req = PolicyRequest(user)
         if "request" in self._context:
-            req = self._context["request"]
+            req = deepcopy(self._context["request"])
         req.context.update(kwargs)
         proc = PolicyProcess(PolicyBinding(policy=policy), request=req, connection=None)
         return proc.profiling_wrapper()

authentik/policies/expression/tests.py

@@ -111,6 +111,25 @@ class TestEvaluator(TestCase):
         res = proc.profiling_wrapper()
         self.assertEqual(res.messages, ("/", "/", "/"))
 
+    def test_call_policy_kwargs_pollute(self):
+        """test ak_call_policy"""
+        expr = ExpressionPolicy.objects.create(
+            name=generate_id(),
+            execution_logging=True,
+            expression="return context.get('subkey', False)",
+        )
+        expr2 = ExpressionPolicy.objects.create(
+            name=generate_id(),
+            execution_logging=True,
+            expression=f"""
+            ak_message(ak_call_policy('{expr.name}', subkey=True).passing)
+            ak_message(ak_call_policy('{expr.name}').passing)
+            """,
+        )
+        proc = PolicyProcess(PolicyBinding(policy=expr2), request=self.request, connection=None)
+        res = proc.profiling_wrapper()
+        self.assertEqual(res.messages, (True, False))
+
     def test_call_policy_test_like(self):
         """test ak_call_policy without `obj` set, as if it was when testing policies"""
         expr = ExpressionPolicy.objects.create(