harden(gateway): prefix-boundary + path-traversal checks; simplify ticket validation

Tighten the stream-ticket authorization in the gateway middleware:
- Enforce a path-segment boundary on the prefix check instead of a bare
  StartsWith, so a ticket for 'users/12' no longer grants 'users/1234/...'
  (exact-match still allowed for single-object grants)
- Reject object keys containing '..'/'.' segments before proxying, closing a
  path-traversal bypass that SeaweedFS would otherwise resolve outside the
  authorized prefix

Also simplify TicketValidator.ValidateTicketAsync from ErrorOr<string> to
string? (null = invalid) since it has a single failure mode; drop the now
unused ErrorOr package reference from the gateway.

Verified: build clean; the authorization predicate passes a table of cases
covering both the escalation and traversal vulnerabilities.

Build: 0 warnings, 0 errors.

This commit is contained in:

Admin

2026-07-05 21:50:43 +02:00

parent 695f4378c6

commit 3e03fbf078

3 changed files with 28 additions and 20 deletions

									
										backend/Musify.StreamingGateway/Musify.StreamingGateway.csproj
									
		-1
	
												View File
												
				@@ -5,7 +5,6 @@

				  </PropertyGroup>

				  <ItemGroup>

				    <PackageReference Include="ErrorOr" />

				    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />

				    <PackageReference Include="Yarp.ReverseProxy" />

				  </ItemGroup>