Enviar #1033604: https://github.com/201206030/ novel 3.5.0 Authorization Bypass Through User-Controlled Key

Validate chapter authorship on the two read-side operations

## Summary

Any registered author can read another author's chapter content, including unpublished drafts and VIP-gated (paid) chapters, and list another author's book's chapters, via the author-backend chapter read endpoints. Neither endpoint checks that the chapter's book belongs to the calling author, unlike the sibling write endpoints.

## Details

PR #50 added an authorship check before chapter delete and chapter update in `BookServiceImpl`:

```java
BookInfoRespDto bookInfo = bookInfoCacheManager.getBookInfo(chapter.getBookId());
if (!Objects.equals(bookInfo.getAuthorId(), UserHolder.getAuthorId())) {
return RestResp.fail(ErrorCodeEnum.USER_UN_AUTH);
}
```

The two read-side siblings never got the same check: `getBookChapter(chapterId)` returns the chapter's name, content, and VIP flag with no check at all, and `listBookChapters(bookId, dto)` lists a book's chapters by raw `bookId` with no check at all. Both are reachable from `AuthorController` (`GET /api/author/book/chapter/{chapterId}` and `GET /api/author/book/chapters/{bookId}`) by any logged-in author, regardless of which book the chapter or id belongs to.

## POC

(available upon request)

## Impact

Any registered author can read the full text of another author's chapter, including unpublished drafts and VIP-gated (paid-subscriber-only) chapters, and enumerate another author's book's chapter list, with no relationship to that book. This is a disclosure of unpublished work and a bypass of the VIP paywall for any author account on the platform.

## Fix

Adds the same `bookInfo.getAuthorId() == UserHolder.getAuthorId()` check PR #50 already uses for delete/update to these two read paths.

Live-validated against the running application (real MySQL + Redis, two real registered authors, a real VIP chapter): before the fix, Author B's token successfully retrieved Author A's VIP chapter content and chapter list; after the fix, both return `USER_UN_AUTH`, while Author A's own access is unaffected.

• Fuente: ⚠️ https://github.com/201206030/novel/pull/51
• Usuario: carfeii (UID 97470)
• Sumisión: 2026-10-14 14:56 (hace 23 días)
• Moderación: 2026-11-06 10:40 (23 days later)
• Estado: Aceptado
• Entrada de VulDB: 431794 [xxyopen/201206030 novel hasta 3.5.0 Book Chapter Read BookServiceImpl.java getBookChapter chapterId escalada de privilegios]
• Puntos: 20