{"abstract":"Part media types cannot insert extra framing lines.","category":"HTTP ranges","checks":6,"contract":"Return media_type if it contains neither CR nor LF; otherwise return application/octet-stream. This local serializer does not accept folded fields.","contract_signature":"media_type","evaluation_group":"s3-http_ranges-multipart","failed_approach":"The partial repair uses return media_type.replace(\"\\r\\n\", \" \"), which still violates the stated contract.","family":"s3-http_ranges-multipart-header-injection","id":"FA-26486","implementations":{"attempt":{"sha256":"73fa7eae4ad8e843bad2391e1b8f91cb5425d627929f5f99b0caa1ed34faeb4b","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\n\nN = 1\nobservations = []\ndef solve(media_type):\n    return media_type.replace(\"\\r\\n\", \" \")\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('multipart-header-injection fixture 0', solve(\"text/x\\r\\nX: \"+str(N)), \"application/octet-stream\")\ncheck('multipart-header-injection fixture 1', solve(\"text/x\\nX: y\"), \"application/octet-stream\")\ncheck('multipart-header-injection fixture 2', solve(\"text/x\\rX: y\"), \"application/octet-stream\")\ncheck('multipart-header-injection fixture 3', solve(\"text/plain\"), \"text/plain\")\ncheck('multipart-header-injection fixture 4', solve(\"application/x; n=\"+str(N)), \"application/x; n=\"+str(N))\ncheck('multipart-header-injection fixture 5', solve(\"\"), \"\")\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"54a965222f53c8cb4aa01ee95b8170e9fd9dc94f4a3208b257679007c454f112","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\n\nN = 1\nobservations = []\ndef solve(media_type):\n    return media_type\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('multipart-header-injection fixture 0', solve(\"text/x\\r\\nX: \"+str(N)), \"application/octet-stream\")\ncheck('multipart-header-injection fixture 1', solve(\"text/x\\nX: y\"), \"application/octet-stream\")\ncheck('multipart-header-injection fixture 2', solve(\"text/x\\rX: y\"), \"application/octet-stream\")\ncheck('multipart-header-injection fixture 3', solve(\"text/plain\"), \"text/plain\")\ncheck('multipart-header-injection fixture 4', solve(\"application/x; n=\"+str(N)), \"application/x; n=\"+str(N))\ncheck('multipart-header-injection fixture 5', solve(\"\"), \"\")\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Deterministic simplified range service, with stipulated local policies and already parsed trusted inputs; not a complete HTTP implementation. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"s3-http_ranges-multipart-header-injection","generated_at":"2026-09-29T14:41:16.395865+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"Range responses combine representation identity, conditional requests, framing, and partial-object state.","root_cause":"The multipart-header-injection decision uses return media_type.","sha256":"20420d9af5b8c4685782a98b8fcaec1691cf20f9d196dc6e506a3bc6307a9e12","title":"Part media types cannot insert extra framing lines · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verified":true,"visibility":"public","verification":{"attempt":{"elapsed_ms":40.022,"exit_code":1,"observations":[{"actual":"text/x X: 1","check":"multipart-header-injection fixture 0","expected":"application/octet-stream","passed":false},{"actual":"text/x\nX: y","check":"multipart-header-injection fixture 1","expected":"application/octet-stream","passed":false},{"actual":"text/x\rX: y","check":"multipart-header-injection fixture 2","expected":"application/octet-stream","passed":false},{"actual":"text/plain","check":"multipart-header-injection fixture 3","expected":"text/plain","passed":true},{"actual":"application/x; n=1","check":"multipart-header-injection fixture 4","expected":"application/x; n=1","passed":true},{"actual":"","check":"multipart-header-injection fixture 5","expected":"","passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"multipart-header-injection fixture 0\", \"actual\": \"text/x X: 1\", \"expected\": \"application/octet-stream\", \"passed\": false}, {\"check\": \"multipart-header-injection fixture 1\", \"actual\": \"text/x\\nX: y\", \"expected\": \"application/octet-stream\", \"passed\": false}, {\"check\": \"multipart-header-injection fixture 2\", \"actual\": \"text/x\\rX: y\", \"expected\": \"application/octet-stream\", \"passed\": false}, {\"check\": \"multipart-header-injection fixture 3\", \"actual\": \"text/plain\", \"expected\": \"text/plain\", \"passed\": true}, {\"check\": \"multipart-header-injection fixture 4\", \"actual\": \"application/x; n=1\", \"expected\": \"application/x; n=1\", \"passed\": true}, {\"check\": \"multipart-header-injection fixture 5\", \"actual\": \"\", \"expected\": \"\", \"passed\": true}], \"passed\": false}\n"},"broken":{"elapsed_ms":41.206,"exit_code":1,"observations":[{"actual":"text/x\r\nX: 1","check":"multipart-header-injection fixture 0","expected":"application/octet-stream","passed":false},{"actual":"text/x\nX: y","check":"multipart-header-injection fixture 1","expected":"application/octet-stream","passed":false},{"actual":"text/x\rX: y","check":"multipart-header-injection fixture 2","expected":"application/octet-stream","passed":false},{"actual":"text/plain","check":"multipart-header-injection fixture 3","expected":"text/plain","passed":true},{"actual":"application/x; n=1","check":"multipart-header-injection fixture 4","expected":"application/x; n=1","passed":true},{"actual":"","check":"multipart-header-injection fixture 5","expected":"","passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"multipart-header-injection fixture 0\", \"actual\": \"text/x\\r\\nX: 1\", \"expected\": \"application/octet-stream\", \"passed\": false}, {\"check\": \"multipart-header-injection fixture 1\", \"actual\": \"text/x\\nX: y\", \"expected\": \"application/octet-stream\", \"passed\": false}, {\"check\": \"multipart-header-injection fixture 2\", \"actual\": \"text/x\\rX: y\", \"expected\": \"application/octet-stream\", \"passed\": false}, {\"check\": \"multipart-header-injection fixture 3\", \"actual\": \"text/plain\", \"expected\": \"text/plain\", \"passed\": true}, {\"check\": \"multipart-header-injection fixture 4\", \"actual\": \"application/x; n=1\", \"expected\": \"application/x; n=1\", \"passed\": true}, {\"check\": \"multipart-header-injection fixture 5\", \"actual\": \"\", \"expected\": \"\", \"passed\": true}], \"passed\": false}\n"}},"member_only":{"stages":["fixed"],"fields":["implementations.fixed","verification.fixed","harness","repair"],"note":"The verified repair, its recorded checks, the repair description, and the scoring harness are available to members."}}