AdminandClaude Opus 4.8
45ce66a6ee
Tighten the stream-ticket authorization in the gateway middleware: - Enforce a path-segment boundary on the prefix check instead of a bare StartsWith, so a ticket for 'users/12' no longer grants 'users/1234/...' (exact-match still allowed for single-object grants) - Reject object keys containing '..'/'.' segments before proxying, closing a path-traversal bypass that SeaweedFS would otherwise resolve outside the authorized prefix Also simplify TicketValidator.ValidateTicketAsync from ErrorOr<string> to string? (null = invalid) since it has a single failure mode; drop the now unused ErrorOr package reference from the gateway. Verified: build clean; the authorization predicate passes a table of cases covering both the escalation and traversal vulnerabilities. Build: 0 warnings, 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
13 lines
330 B
XML
13 lines
330 B
XML
<Project Sdk="Microsoft.NET.Sdk.Web">
|
|
|
|
<PropertyGroup>
|
|
<UserSecretsId>media-gateway-2f1c9b6a-7d3e-4c0a-9a21-0b8e5d4c3f10</UserSecretsId>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
|
|
<PackageReference Include="Yarp.ReverseProxy" />
|
|
</ItemGroup>
|
|
|
|
</Project>
|