ABE's DSL checks for completeness, not input exhaustion, and silently ignores policies beyond complete grammar

(This was previously reported to, and categorized as "Informational" and outside their threat model by, Cloudflare)

When the DSL parses the policy string, it does not check for exhaustion of input, but a complete grammar. A typo or inserted character may silently drop intended policy restrictions or allowances.

Start by locating the ABE DSL policy-string parser and the tests covering policy grammar. Reproduce a policy with a complete grammar followed by an extra character or policy fragment, then trace whether the parser reports trailing input. Done means malformed or non-exhausted input no longer silently drops policy restrictions or allowances.

Written by the indexing model from the issue text.