CVE-2026-50569: Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check.

A tenant with HTTPTrigger create permission could therefore create triggers whose RelativeURL or Prefix:

• was empty (with both fields unset, the trigger has no URL),
• did not start with /,
• was exactly / (claiming the entire router root),
• contained .. traversal segments (e.g. /api/../admin),
• collided with router-owned routes: /router-healthz, /readyz, /_version, /auth/login,
• collided with the router-internal function prefix /fission-function/<ns>/<name>.