Invia #1033604: https://github.com/201206030/ novel 3.5.0 Authorization Bypass Through User-Controlled Key

Validate chapter authorship on the two read-side operations

## Summary

Any registered author can read another author's chapter content, including unpublished drafts and VIP-gated (paid) chapters, and list another author's book's chapters, via the author-backend chapter read endpoints. Neither endpoint checks that the chapter's book belongs to the calling author, unlike the sibling write endpoints.

## Details

PR #50 added an authorship check before chapter delete and chapter update in `BookServiceImpl`:

```java
BookInfoRespDto bookInfo = bookInfoCacheManager.getBookInfo(chapter.getBookId());
if (!Objects.equals(bookInfo.getAuthorId(), UserHolder.getAuthorId())) {
return RestResp.fail(ErrorCodeEnum.USER_UN_AUTH);
}
```

The two read-side siblings never got the same check: `getBookChapter(chapterId)` returns the chapter's name, content, and VIP flag with no check at all, and `listBookChapters(bookId, dto)` lists a book's chapters by raw `bookId` with no check at all. Both are reachable from `AuthorController` (`GET /api/author/book/chapter/{chapterId}` and `GET /api/author/book/chapters/{bookId}`) by any logged-in author, regardless of which book the chapter or id belongs to.

## POC

(available upon request)

## Impact

Any registered author can read the full text of another author's chapter, including unpublished drafts and VIP-gated (paid-subscriber-only) chapters, and enumerate another author's book's chapter list, with no relationship to that book. This is a disclosure of unpublished work and a bypass of the VIP paywall for any author account on the platform.

## Fix

Adds the same `bookInfo.getAuthorId() == UserHolder.getAuthorId()` check PR #50 already uses for delete/update to these two read paths.

Live-validated against the running application (real MySQL + Redis, two real registered authors, a real VIP chapter): before the fix, Author B's token successfully retrieved Author A's VIP chapter content and chapter list; after the fix, both return `USER_UN_AUTH`, while Author A's own access is unaffected.

• Fonte: ⚠️ https://github.com/201206030/novel/pull/51
• Utente: carfeii (UID 97470)
• Sottomissione: 14/10/2026 14:56 (23 giorni fa)
• Moderazione: 06/11/2026 10:40 (23 days later)
• Stato: Accettato
• Voce VulDB: 431794 [xxyopen/201206030 novel fino a 3.5.0 Book Chapter Read BookServiceImpl.java getBookChapter chapterId escalationi di privilegi]
• Punti: 20