FA-26846 / HTTP ranges / Open access

Multipart boundary parameter parsing: quoted escapes preserve the escaped character · case 01

Multipart boundary parameter parsing: quoted escapes preserve the escaped character.

Verified by executionVariant 1 · 18 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The multipart-boundary-parameter-quoted-escape decision uses parts=[] current='' quoted=False escaped=False for c in x: if escaped: current+='\\'+c escaped=False elif quoted and c=='\\': escaped=True elif c=='"': quoted=not quoted elif c==';' and not quoted: parts.append(current) current='' else: current+=c if quoted or escaped: return None parts.append(current) if parts[0].strip().lower()!='multipart/byteranges': return None boundaries=[] for part in parts[1:]: if '=' not in part: continue key,value=part.split('=',1) if key.strip().lower()=='boundary': boundaries.append(value.strip()) if len(boundaries)!=1: return None value=boundaries[0] if not 1<=len(value)<=12: return None if any(ord(c)<32 or ord(c)>126 for c in value): return None return value.

VERIFIED REPAIR

Apply the bounded decision exactly: parts=[] current='' quoted=False escaped=False for c in x: if escaped: current+=c escaped=False elif quoted and c=='\\': escaped=True elif c=='"': quoted=not quoted elif c==';' and not quoted: parts.append(current) current='' else: current+=c if quoted or escaped: return None parts.append(current) if parts[0].strip().lower()!='multipart/byteranges': return None boundaries=[] for part in parts[1:]: if '=' not in part: continue key,value=part.split('=',1) if key.strip().lower()=='boundary': boundaries.append(value.strip()) if len(boundaries)!=1: return None value=boundaries[0] if not 1<=len(value)<=12: return None if any(ord(c)<32 or ord(c)>126 for c in value): return None return value

Unsuccessful approach: The partial repair uses parts=[] current='' quoted=False escaped=False for c in x: if escaped: current+=c if c!='\\' else '' escaped=False elif quoted and c=='\\': escaped=True elif c=='"': quoted=not quoted elif c==';' and not quoted: parts.append(current) current='' else: current+=c if quoted or escaped: return None parts.append(current) if parts[0].strip().lower()!='multipart/byteranges': return None boundaries=[] for part in parts[1:]: if '=' not in part: continue key,value=part.split('=',1) if key.strip().lower()=='boundary': boundaries.append(value.strip()) if len(boundaries)!=1: return None value=boundaries[0] if not 1<=len(value)<=12: return None if any(ord(c)<32 or ord(c)>126 for c in value): return None return value, which still violates the stated contract.

Case contract

Parse a bounded Content-Type string with semicolon-separated parameters, quoted strings and backslash escapes inside quotes. Require multipart/byteranges (case-insensitive) and exactly one boundary parameter, with 1..12 ASCII printable characters excluding CR/LF. Other parameters ignored. Unbalanced quotes or dangling quoted escapes reject. Input x is the field string.

Why this case matters

Range responses combine representation identity, conditional requests, framing, and partial-object state.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(x):
    parts=[]
    current=''
    quoted=False
    escaped=False
    for c in x:
        if escaped:
            current+='\\'+c
            escaped=False
        elif quoted and c=='\\':
            escaped=True
        elif c=='"':
            quoted=not quoted
        elif c==';' and not quoted:
            parts.append(current)
            current=''
        else:
            current+=c
    if quoted or escaped: return None
    parts.append(current)
    if parts[0].strip().lower()!='multipart/byteranges': return None
    boundaries=[]
    for part in parts[1:]:
        if '=' not in part: continue
        key,value=part.split('=',1)
        if key.strip().lower()=='boundary': boundaries.append(value.strip())
    if len(boundaries)!=1: return None
    value=boundaries[0]
    if not 1<=len(value)<=12: return None
    if any(ord(c)<32 or ord(c)>126 for c in value): return None
    return value
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('quoted-escape fixture 0', json.loads(json.dumps(solve('multipart/byteranges; boundary="a;b"'))), json.loads(json.dumps('a;b')))
check('quoted-escape fixture 1', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\"b"'))), json.loads(json.dumps('a"b')))
check('quoted-escape fixture 2', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\\\b"'))), json.loads(json.dumps('a\\b')))
check('quoted-escape fixture 3', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 4', json.loads(json.dumps(solve(' Multipart/ByteRanges ; BOUNDARY = abc '))), json.loads(json.dumps('abc')))
check('quoted-escape fixture 5', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=a'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 6', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=b'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 7', json.loads(json.dumps(solve('multipart/mixed; boundary=a'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 8', json.loads(json.dumps(solve('multipart/byteranges; boundary='))), json.loads(json.dumps(None)))
check('quoted-escape fixture 9', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijkl'))), json.loads(json.dumps('abcdefghijkl')))
check('quoted-escape fixture 10', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijklm'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 11', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\nb'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 12', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\x7fb'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 13', json.loads(json.dumps(solve('multipart/byteranges; x=y'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 14', json.loads(json.dumps(solve("p"*N))), json.loads(json.dumps(None)))
check('quoted-escape fixture 15', json.loads(json.dumps(solve("multipart/byteranges; boundary=b"+str(N)))), json.loads(json.dumps("b"+str(N))))
check('quoted-escape fixture 16', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc"'))), json.loads(json.dumps('abc')))
check('quoted-escape fixture 17', json.loads(json.dumps(solve('multipart/byteranges; x=a=b; boundary=ab'))), json.loads(json.dumps('ab')))
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
quoted-escape fixture 0	`a;b`	`a;b`	Passed
quoted-escape fixture 1	`a\"b`	`a"b`	Failed
quoted-escape fixture 2	`a\\b`	`a\b`	Failed
quoted-escape fixture 3	`None`	`None`	Passed
quoted-escape fixture 4	`abc`	`abc`	Passed
quoted-escape fixture 5	`None`	`None`	Passed
quoted-escape fixture 6	`None`	`None`	Passed
quoted-escape fixture 7	`None`	`None`	Passed
quoted-escape fixture 8	`None`	`None`	Passed
quoted-escape fixture 9	`abcdefghijkl`	`abcdefghijkl`	Passed
quoted-escape fixture 10	`None`	`None`	Passed
quoted-escape fixture 11	`None`	`None`	Passed
quoted-escape fixture 12	`None`	`None`	Passed
quoted-escape fixture 13	`None`	`None`	Passed
quoted-escape fixture 14	`None`	`None`	Passed
quoted-escape fixture 15	`b1`	`b1`	Passed
quoted-escape fixture 16	`abc`	`abc`	Passed
quoted-escape fixture 17	`ab`	`ab`	Passed

SHA-256 / 1bda338c66e4679ab518e9c43c315cfc4ab3efe571b006e7fee3c5deb2481a8c

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(x):
    parts=[]
    current=''
    quoted=False
    escaped=False
    for c in x:
        if escaped:
            current+=c if c!='\\' else ''
            escaped=False
        elif quoted and c=='\\':
            escaped=True
        elif c=='"':
            quoted=not quoted
        elif c==';' and not quoted:
            parts.append(current)
            current=''
        else:
            current+=c
    if quoted or escaped: return None
    parts.append(current)
    if parts[0].strip().lower()!='multipart/byteranges': return None
    boundaries=[]
    for part in parts[1:]:
        if '=' not in part: continue
        key,value=part.split('=',1)
        if key.strip().lower()=='boundary': boundaries.append(value.strip())
    if len(boundaries)!=1: return None
    value=boundaries[0]
    if not 1<=len(value)<=12: return None
    if any(ord(c)<32 or ord(c)>126 for c in value): return None
    return value
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('quoted-escape fixture 0', json.loads(json.dumps(solve('multipart/byteranges; boundary="a;b"'))), json.loads(json.dumps('a;b')))
check('quoted-escape fixture 1', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\"b"'))), json.loads(json.dumps('a"b')))
check('quoted-escape fixture 2', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\\\b"'))), json.loads(json.dumps('a\\b')))
check('quoted-escape fixture 3', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 4', json.loads(json.dumps(solve(' Multipart/ByteRanges ; BOUNDARY = abc '))), json.loads(json.dumps('abc')))
check('quoted-escape fixture 5', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=a'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 6', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=b'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 7', json.loads(json.dumps(solve('multipart/mixed; boundary=a'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 8', json.loads(json.dumps(solve('multipart/byteranges; boundary='))), json.loads(json.dumps(None)))
check('quoted-escape fixture 9', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijkl'))), json.loads(json.dumps('abcdefghijkl')))
check('quoted-escape fixture 10', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijklm'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 11', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\nb'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 12', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\x7fb'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 13', json.loads(json.dumps(solve('multipart/byteranges; x=y'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 14', json.loads(json.dumps(solve("p"*N))), json.loads(json.dumps(None)))
check('quoted-escape fixture 15', json.loads(json.dumps(solve("multipart/byteranges; boundary=b"+str(N)))), json.loads(json.dumps("b"+str(N))))
check('quoted-escape fixture 16', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc"'))), json.loads(json.dumps('abc')))
check('quoted-escape fixture 17', json.loads(json.dumps(solve('multipart/byteranges; x=a=b; boundary=ab'))), json.loads(json.dumps('ab')))
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
quoted-escape fixture 0	`a;b`	`a;b`	Passed
quoted-escape fixture 1	`a"b`	`a"b`	Passed
quoted-escape fixture 2	`ab`	`a\b`	Failed
quoted-escape fixture 3	`None`	`None`	Passed
quoted-escape fixture 4	`abc`	`abc`	Passed
quoted-escape fixture 5	`None`	`None`	Passed
quoted-escape fixture 6	`None`	`None`	Passed
quoted-escape fixture 7	`None`	`None`	Passed
quoted-escape fixture 8	`None`	`None`	Passed
quoted-escape fixture 9	`abcdefghijkl`	`abcdefghijkl`	Passed
quoted-escape fixture 10	`None`	`None`	Passed
quoted-escape fixture 11	`None`	`None`	Passed
quoted-escape fixture 12	`None`	`None`	Passed
quoted-escape fixture 13	`None`	`None`	Passed
quoted-escape fixture 14	`None`	`None`	Passed
quoted-escape fixture 15	`b1`	`b1`	Passed
quoted-escape fixture 16	`abc`	`abc`	Passed
quoted-escape fixture 17	`ab`	`ab`	Passed

SHA-256 / a2ec4aa486dff1d2903de9980d7a810382063414b2b0ee4391450b949bed94f0

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(x):
    parts=[]
    current=''
    quoted=False
    escaped=False
    for c in x:
        if escaped:
            current+=c
            escaped=False
        elif quoted and c=='\\':
            escaped=True
        elif c=='"':
            quoted=not quoted
        elif c==';' and not quoted:
            parts.append(current)
            current=''
        else:
            current+=c
    if quoted or escaped: return None
    parts.append(current)
    if parts[0].strip().lower()!='multipart/byteranges': return None
    boundaries=[]
    for part in parts[1:]:
        if '=' not in part: continue
        key,value=part.split('=',1)
        if key.strip().lower()=='boundary': boundaries.append(value.strip())
    if len(boundaries)!=1: return None
    value=boundaries[0]
    if not 1<=len(value)<=12: return None
    if any(ord(c)<32 or ord(c)>126 for c in value): return None
    return value
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('quoted-escape fixture 0', json.loads(json.dumps(solve('multipart/byteranges; boundary="a;b"'))), json.loads(json.dumps('a;b')))
check('quoted-escape fixture 1', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\"b"'))), json.loads(json.dumps('a"b')))
check('quoted-escape fixture 2', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\\\b"'))), json.loads(json.dumps('a\\b')))
check('quoted-escape fixture 3', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 4', json.loads(json.dumps(solve(' Multipart/ByteRanges ; BOUNDARY = abc '))), json.loads(json.dumps('abc')))
check('quoted-escape fixture 5', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=a'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 6', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=b'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 7', json.loads(json.dumps(solve('multipart/mixed; boundary=a'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 8', json.loads(json.dumps(solve('multipart/byteranges; boundary='))), json.loads(json.dumps(None)))
check('quoted-escape fixture 9', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijkl'))), json.loads(json.dumps('abcdefghijkl')))
check('quoted-escape fixture 10', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijklm'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 11', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\nb'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 12', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\x7fb'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 13', json.loads(json.dumps(solve('multipart/byteranges; x=y'))), json.loads(json.dumps(None)))
check('quoted-escape fixture 14', json.loads(json.dumps(solve("p"*N))), json.loads(json.dumps(None)))
check('quoted-escape fixture 15', json.loads(json.dumps(solve("multipart/byteranges; boundary=b"+str(N)))), json.loads(json.dumps("b"+str(N))))
check('quoted-escape fixture 16', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc"'))), json.loads(json.dumps('abc')))
check('quoted-escape fixture 17', json.loads(json.dumps(solve('multipart/byteranges; x=a=b; boundary=ab'))), json.loads(json.dumps('ab')))
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
quoted-escape fixture 0	`a;b`	`a;b`	Passed
quoted-escape fixture 1	`a"b`	`a"b`	Passed
quoted-escape fixture 2	`a\b`	`a\b`	Passed
quoted-escape fixture 3	`None`	`None`	Passed
quoted-escape fixture 4	`abc`	`abc`	Passed
quoted-escape fixture 5	`None`	`None`	Passed
quoted-escape fixture 6	`None`	`None`	Passed
quoted-escape fixture 7	`None`	`None`	Passed
quoted-escape fixture 8	`None`	`None`	Passed
quoted-escape fixture 9	`abcdefghijkl`	`abcdefghijkl`	Passed
quoted-escape fixture 10	`None`	`None`	Passed
quoted-escape fixture 11	`None`	`None`	Passed
quoted-escape fixture 12	`None`	`None`	Passed
quoted-escape fixture 13	`None`	`None`	Passed
quoted-escape fixture 14	`None`	`None`	Passed
quoted-escape fixture 15	`b1`	`b1`	Passed
quoted-escape fixture 16	`abc`	`abc`	Passed
quoted-escape fixture 17	`ab`	`ab`	Passed

SHA-256 / 4e3e2af71a1aab2253f1f627ea871c455f45a392d95d448fcd9b6a6b6d1fd9c2

Verification & scope

Deterministic simplified range service, with stipulated local policies and already parsed trusted inputs; not a complete HTTP implementation. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:41:19.553311+00:00.

Case digest / 2183df972106118b3ddd57cfb76d326849baa8a866936a36300babd64472c24c