[sharanggupta]

fixes #2924

What happened: WildcardPermission.setParts implements the default case-insensitive mode with wildcardString.toLowerCase(), and DomainPermission.getDomain derives the domain with clazz.getSimpleName().toLowerCase(). Both follow the JVM default locale. On a JVM whose default locale is Turkish (tr-TR — the default on any Turkish OS/user account; -Duser.language=tr -Duser.country=TR reproduces it anywhere) an uppercase I lower-cases to a dotless ı (U+0131), so the "case-insensitive" comparison is no longer case-insensitive for any token containing I/i:

default locale = tr_TR                       (shiro-core 3.0.1)
"ADMIN:*" implies "admin:read"               = false   (granted parts: admın:*, checked parts: admin:read)
"admin:*" implies "ADMIN:read"               = false
InvoicePermission.getDomain()                = ınvoice
"invoice:*" implies InvoicePermission("view") = false

Under en-US every line is true/invoice. Permission strings are machine-read (realm data, @RequiresPermissions, isPermitted(...)), so a grant stored as ADMIN:* silently stops matching admin:read, and any DomainPermission subclass with a capital I in its name (InvoicePermission, InventoryPermission, …) never matches its configured domain.

This is the same class of bug fixed in SHIRO-415 ("BASIC".toLowerCase() in isLoginAttempt) and SHIRO-483 (passwordsMatch under tr_TR); those fixes used Locale.ENGLISH, as do HttpAuthenticationFilter, SimpleCookie and the hash-format classes today. Secondary site with the same shape: DefaultWebSessionManager looks for the JSESSIONID URL parameter via name.toLowerCase() (jsessıonıd under tr-TR).

How to reproduce: run the snippet above (or any WildcardPermission check with an I in a token) with -Duser.language=tr -Duser.country=TR.

Expected: case-insensitive permission matching independent of the host locale.

Versions: 3.0.1 (and main); any JDK.

Fix: toLowerCase(Locale.ENGLISH) at WildcardPermission.java:158 and DomainPermission.java:98 (+ DefaultWebSessionManager), with a test that sets the default locale to tr-TR around a WildcardPermission("ADMIN:*").implies(new WildcardPermission("admin:read")) check. I have the change ready.

• I have the right to license this contribution to the Apache Software Foundation under the Apache License, Version 2.0.
• mvn verify run on core (JDK 21); the new PermissionDefaultLocaleTest is @Isolated because the suite runs methods concurrently.