| タイトル | https://github.com/201206030/ novel 3.5.0 Authorization Bypass Through User-Controlled Key |
|---|
| 説明 | Validate chapter authorship on the two read-side operations
## Summary
Any registered author can read another author's chapter content, including unpublished drafts and VIP-gated (paid) chapters, and list another author's book's chapters, via the author-backend chapter read endpoints. Neither endpoint checks that the chapter's book belongs to the calling author, unlike the sibling write endpoints.
## Details
PR #50 added an authorship check before chapter delete and chapter update in `BookServiceImpl`:
```java
BookInfoRespDto bookInfo = bookInfoCacheManager.getBookInfo(chapter.getBookId());
if (!Objects.equals(bookInfo.getAuthorId(), UserHolder.getAuthorId())) {
return RestResp.fail(ErrorCodeEnum.USER_UN_AUTH);
}
```
The two read-side siblings never got the same check: `getBookChapter(chapterId)` returns the chapter's name, content, and VIP flag with no check at all, and `listBookChapters(bookId, dto)` lists a book's chapters by raw `bookId` with no check at all. Both are reachable from `AuthorController` (`GET /api/author/book/chapter/{chapterId}` and `GET /api/author/book/chapters/{bookId}`) by any logged-in author, regardless of which book the chapter or id belongs to.
## POC
(available upon request)
## Impact
Any registered author can read the full text of another author's chapter, including unpublished drafts and VIP-gated (paid-subscriber-only) chapters, and enumerate another author's book's chapter list, with no relationship to that book. This is a disclosure of unpublished work and a bypass of the VIP paywall for any author account on the platform.
## Fix
Adds the same `bookInfo.getAuthorId() == UserHolder.getAuthorId()` check PR #50 already uses for delete/update to these two read paths.
Live-validated against the running application (real MySQL + Redis, two real registered authors, a real VIP chapter): before the fix, Author B's token successfully retrieved Author A's VIP chapter content and chapter list; after the fix, both return `USER_UN_AUTH`, while Author A's own access is unaffected.
|
|---|
| ソース | ⚠️ https://github.com/201206030/novel/pull/51 |
|---|
| ユーザー | carfeii (UID 97470) |
|---|
| 送信 | 2026年10月14日 14:56 (23 日 ago) |
|---|
| モデレーション | 2026年11月06日 10:40 (23 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 431794 [xxyopen/201206030 novel 迄 3.5.0 Book Chapter Read BookServiceImpl.java getBookChapter chapterId 特権昇格] |
|---|
| ポイント | 20 |
|---|