| 标题 | https://github.com/201206030/ novel 3.5.0 Authorization Bypass Through User-Controlled Key |
|---|
| 描述 | Validate chapter authorship on the two read-side operations
## Summary
Any registered author can read another author's chapter content, including unpublished drafts and VIP-gated (paid) chapters, and list another author's book's chapters, via the author-backend chapter read endpoints. Neither endpoint checks that the chapter's book belongs to the calling author, unlike the sibling write endpoints.
## Details
PR #50 added an authorship check before chapter delete and chapter update in `BookServiceImpl`:
```java
BookInfoRespDto bookInfo = bookInfoCacheManager.getBookInfo(chapter.getBookId());
if (!Objects.equals(bookInfo.getAuthorId(), UserHolder.getAuthorId())) {
return RestResp.fail(ErrorCodeEnum.USER_UN_AUTH);
}
```
The two read-side siblings never got the same check: `getBookChapter(chapterId)` returns the chapter's name, content, and VIP flag with no check at all, and `listBookChapters(bookId, dto)` lists a book's chapters by raw `bookId` with no check at all. Both are reachable from `AuthorController` (`GET /api/author/book/chapter/{chapterId}` and `GET /api/author/book/chapters/{bookId}`) by any logged-in author, regardless of which book the chapter or id belongs to.
## POC
(available upon request)
## Impact
Any registered author can read the full text of another author's chapter, including unpublished drafts and VIP-gated (paid-subscriber-only) chapters, and enumerate another author's book's chapter list, with no relationship to that book. This is a disclosure of unpublished work and a bypass of the VIP paywall for any author account on the platform.
## Fix
Adds the same `bookInfo.getAuthorId() == UserHolder.getAuthorId()` check PR #50 already uses for delete/update to these two read paths.
Live-validated against the running application (real MySQL + Redis, two real registered authors, a real VIP chapter): before the fix, Author B's token successfully retrieved Author A's VIP chapter content and chapter list; after the fix, both return `USER_UN_AUTH`, while Author A's own access is unaffected.
|
|---|
| 来源 | ⚠️ https://github.com/201206030/novel/pull/51 |
|---|
| 用户 | carfeii (UID 97470) |
|---|
| 提交 | 2026-10-14 14時56分 (23 日前) |
|---|
| 管理 | 2026-11-06 10時40分 (23 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 431794 [xxyopen/201206030 novel 直到 3.5.0 Book Chapter Read BookServiceImpl.java getBookChapter chapterId 权限提升] |
|---|
| 积分 | 20 |
|---|