CVE-2026-50569

@@ -1,40 +0,0 @@-// SPDX-FileCopyrightText: The Fission Authors-//-// SPDX-License-Identifier: Apache-2.0--package webhook--import (-	ctrl "sigs.k8s.io/controller-runtime"-	"sigs.k8s.io/controller-runtime/pkg/webhook"--	v1 "github.com/fission/fission/pkg/apis/core/v1"-	"github.com/fission/fission/pkg/utils/loggerfactory"-)--type TimeTrigger struct {-	GenericWebhook[*v1.TimeTrigger]-}--func (r *TimeTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {-	r.Logger = loggerfactory.GetLogger().WithName("timetrigger-resource")-	r.Validator = r-	return r.GenericWebhook.SetupWebhookWithManager(mgr, &v1.TimeTrigger{})-}--// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-timetrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=mtimetrigger.fission.io,admissionReviewVersions=v1--var _ webhook.CustomDefaulter = &TimeTrigger{}--// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.-//+kubebuilder:webhook:path=/validate-fission-io-v1-timetrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=vtimetrigger.fission.io,admissionReviewVersions=v1--var _ webhook.CustomValidator = &TimeTrigger{}--func (r *TimeTrigger) Validate(new *v1.TimeTrigger) error {-	if err := new.Validate(); err != nil {-		return v1.AggregateValidationErrors("TimeTrigger", err)-	}--	return nil-}

AI removed a constraint: `r.Validator = r`

@@ -62,14 +62,23 @@ func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger l  	// Setup webhooks +	// HTTPTrigger, TimeTrigger and CanaryConfig no longer need a webhook: their+	// field rules are enforced by the API server via CEL, their parser-based+	// rules that CEL cannot express (cron schedule; CORS origin/max-age and+	// ingress path regex) are reported as status Conditions by the timer and+	// router reconcilers, and CanaryConfig had no validation.+	//+	// The remaining CRDs keep a webhook for the checks CEL cannot express —+	// cross-namespace references, pod-spec/container security (GHSA), the+	// environment runtime-image/name invariant, message-queue type/topic+	// validity, and reference-name (DNS-1123) checks — which still run via each+	// type's Validate(). CEL covers their field rules too; the overlap is+	// deliberate defense-in-depth. 	webhookInjectors := []WebhookInjector{-		&CanaryConfig{}, 		&Environment{}, 		&Package{}, 		&Function{},-		&HTTPTrigger{}, 		&MessageQueueTrigger{},-		&TimeTrigger{}, 		&KubernetesWatchTrigger{}, 	} 

AI introduced this behavior: `// router reconcilers, and CanaryConfig had no validation.`

@@ -1,39 +0,0 @@-// SPDX-FileCopyrightText: The Fission Authors-//-// SPDX-License-Identifier: Apache-2.0--package webhook--import (-	ctrl "sigs.k8s.io/controller-runtime"-	"sigs.k8s.io/controller-runtime/pkg/webhook"--	v1 "github.com/fission/fission/pkg/apis/core/v1"-	"github.com/fission/fission/pkg/utils/loggerfactory"-)--type HTTPTrigger struct {-	GenericWebhook[*v1.HTTPTrigger]-}--func (r *HTTPTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {-	r.Logger = loggerfactory.GetLogger().WithName("httptrigger-resource")-	r.Validator = r-	return r.GenericWebhook.SetupWebhookWithManager(mgr, &v1.HTTPTrigger{})-}--// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-httptrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=mhttptrigger.fission.io,admissionReviewVersions=v1--var _ webhook.CustomDefaulter = &HTTPTrigger{}--// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.-//+kubebuilder:webhook:path=/validate-fission-io-v1-httptrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=vhttptrigger.fission.io,admissionReviewVersions=v1--var _ webhook.CustomValidator = &HTTPTrigger{}--func (r *HTTPTrigger) Validate(new *v1.HTTPTrigger) error {-	if err := new.Validate(); err != nil {-		return v1.AggregateValidationErrors("HTTPTrigger", err)-	}-	return nil-}

AI removed a constraint: `r.Validator = r`