Tighten the stream-ticket authorization in the gateway middleware:
- Enforce a path-segment boundary on the prefix check instead of a bare
StartsWith, so a ticket for 'users/12' no longer grants 'users/1234/...'
(exact-match still allowed for single-object grants)
- Reject object keys containing '..'/'.' segments before proxying, closing a
path-traversal bypass that SeaweedFS would otherwise resolve outside the
authorized prefix
Also simplify TicketValidator.ValidateTicketAsync from ErrorOr<string> to
string? (null = invalid) since it has a single failure mode; drop the now
unused ErrorOr package reference from the gateway.
Verified: build clean; the authorization predicate passes a table of cases
covering both the escalation and traversal vulnerabilities.
Build: 0 warnings, 0 errors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
AdminandClaude Opus 4.8
45ce66a6ee