GHSA-vchh-r53j-8mpw: Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check. A tenant with HTTPTrigger create permission could therefore create triggers whose RelativeURL or Prefix: - was empty (with both fields unset, the trigger has no URL), - did not start with /, - was exactly / (claiming the entire router root), - contained .. traversal segments (e.g. /api/../admin), - collided with router-owned routes: /router-healthz, /readyz, /_version, /auth/login, - collided with the router-internal function prefix /fission-function/<ns>/<name>. Affected - Project: github.com/fission/fission - Versions: all versions through v1.24.0 - Audited commit: 647c141 - Component: pkg/apis/core/v1/validation.go:HTTPTriggerSpec.Validate (and the missing CEL on HTTPTriggerSpec) - Configuration: default Fix section (paste into the Fix / Patches field) Fixed in v1.25.0 by: - PR #3464 (commit 0deed6bf) — enforce the path-safety invariants at both admission layers so the API server's CEL evaluation and the Go-side HTTPTriggerSpec.Validate() agree: - Three +kubebuilder:validation:XValidation rules on HTTPTriggerSpec (the API server's CEL admission gate, regenerated into crds/v1/fission.io_httptriggers.yaml): - at least one of relativeurl or prefix must be non-empty; - relativeurl, when set, must start with /, must not be /, must contain no .. segment, must not be in the reserved exact-path set, and must not start with /fission-function/; - prefix, when set, the same rules guarded by has(self.prefix). - validateTriggerPath helper in pkg/apis/core/v1/validation.go, invok