Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check.

A tenant with HTTPTrigger create permission could therefore create triggers whose RelativeURL or Prefix:

• was empty (with both fields unset, the trigger has no URL),
• did not start with /,
• was exactly / (claiming the entire router root),
• contained .. traversal segments (e.g. /api/../admin),
• collided with router-owned routes: /router-healthz, /readyz, /_version, /auth/login,
• collided with the router-internal function prefix /fission-function/<ns>/<name>.

Affected

• Project: github.com/fission/fission
• Versions: all versions through v1.24.0
• Audited commit: 647c141
• Component: pkg/apis/core/v1/validation.go:HTTPTriggerSpec.Validate (and the missing CEL on HTTPTriggerSpec)
• Configuration: default

Fix section (paste into the Fix / Patches field)

Fixed in v1.25.0 by:

• PR #3464 (commit 0deed6bf) — enforce the path-safety invariants at both admission layers so the API server's CEL evaluation and the Go-side HTTPTriggerSpec.Validate() agree:
  • Three +kubebuilder:validation:XValidation rules on HTTPTriggerSpec (the API server's CEL admission gate, regenerated into ):