FAILURE MAP
← Case archive

FA-26856 / HTTP ranges / Open access

Multipart boundary parameter parsing: incomplete quoted boundaries are rejected · case 01

Multipart boundary parameter parsing: incomplete quoted boundaries are rejected.

Verified by executionVariant 1 · 18 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The multipart-boundary-parameter-incomplete-quote decision uses parts=[] current='' quoted=False escaped=False for c in x: if escaped: current+=c escaped=False elif quoted and c=='\\': escaped=True elif c=='"': quoted=not quoted elif c==';' and not quoted: parts.append(current) current='' else: current+=c if escaped: return None parts.append(current) if parts[0].strip().lower()!='multipart/byteranges': return None boundaries=[] for part in parts[1:]: if '=' not in part: continue key,value=part.split('=',1) if key.strip().lower()=='boundary': boundaries.append(value.strip()) if len(boundaries)!=1: return None value=boundaries[0] if not 1<=len(value)<=12: return None if any(ord(c)<32 or ord(c)>126 for c in value): return None return value.

THE FAILURE

The multipart-boundary-parameter-incomplete-quote decision uses parts=[] current='' quoted=False escaped=False for c in x: if escaped: current+=c escaped=False elif quoted and c=='\\': escaped=True elif c=='"': quoted=not quoted elif c==';' and not quoted: parts.append(current) current='' else: current+=c if escaped: return None parts.append(current) if parts[0].strip().lower()!='multipart/byteranges': return None boundaries=[] for part in parts[1:]: if '=' not in part: continue key,value=part.split('=',1) if key.strip().lower()=='boundary': boundaries.append(value.strip()) if len(boundaries)!=1: return None value=boundaries[0] if not 1<=len(value)<=12: return None if any(ord(c)<32 or ord(c)>126 for c in value): return None return value.

Unsuccessful approach: The partial repair uses parts=[] current='' quoted=False escaped=False for c in x: if escaped: current+=c escaped=False elif quoted and c=='\\': escaped=True elif c=='"': quoted=not quoted elif c==';' and not quoted: parts.append(current) current='' else: current+=c if quoted and escaped: return None parts.append(current) if parts[0].strip().lower()!='multipart/byteranges': return None boundaries=[] for part in parts[1:]: if '=' not in part: continue key,value=part.split('=',1) if key.strip().lower()=='boundary': boundaries.append(value.strip()) if len(boundaries)!=1: return None value=boundaries[0] if not 1<=len(value)<=12: return None if any(ord(c)<32 or ord(c)>126 for c in value): return None return value, which still violates the stated contract.

Case contract

Parse a bounded Content-Type string with semicolon-separated parameters, quoted strings and backslash escapes inside quotes. Require multipart/byteranges (case-insensitive) and exactly one boundary parameter, with 1..12 ASCII printable characters excluding CR/LF. Other parameters ignored. Unbalanced quotes or dangling quoted escapes reject. Input x is the field string.

Why this case matters

Range responses combine representation identity, conditional requests, framing, and partial-object state.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(x):
    parts=[]
    current=''
    quoted=False
    escaped=False
    for c in x:
        if escaped:
            current+=c
            escaped=False
        elif quoted and c=='\\':
            escaped=True
        elif c=='"':
            quoted=not quoted
        elif c==';' and not quoted:
            parts.append(current)
            current=''
        else:
            current+=c
    if escaped: return None
    parts.append(current)
    if parts[0].strip().lower()!='multipart/byteranges': return None
    boundaries=[]
    for part in parts[1:]:
        if '=' not in part: continue
        key,value=part.split('=',1)
        if key.strip().lower()=='boundary': boundaries.append(value.strip())
    if len(boundaries)!=1: return None
    value=boundaries[0]
    if not 1<=len(value)<=12: return None
    if any(ord(c)<32 or ord(c)>126 for c in value): return None
    return value
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('incomplete-quote fixture 0', json.loads(json.dumps(solve('multipart/byteranges; boundary="a;b"'))), json.loads(json.dumps('a;b')))
check('incomplete-quote fixture 1', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\"b"'))), json.loads(json.dumps('a"b')))
check('incomplete-quote fixture 2', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\\\b"'))), json.loads(json.dumps('a\\b')))
check('incomplete-quote fixture 3', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 4', json.loads(json.dumps(solve(' Multipart/ByteRanges ; BOUNDARY = abc '))), json.loads(json.dumps('abc')))
check('incomplete-quote fixture 5', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=a'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 6', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=b'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 7', json.loads(json.dumps(solve('multipart/mixed; boundary=a'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 8', json.loads(json.dumps(solve('multipart/byteranges; boundary='))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 9', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijkl'))), json.loads(json.dumps('abcdefghijkl')))
check('incomplete-quote fixture 10', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijklm'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 11', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\nb'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 12', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\x7fb'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 13', json.loads(json.dumps(solve('multipart/byteranges; x=y'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 14', json.loads(json.dumps(solve("p"*N))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 15', json.loads(json.dumps(solve("multipart/byteranges; boundary=b"+str(N)))), json.loads(json.dumps("b"+str(N))))
check('incomplete-quote fixture 16', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc"'))), json.loads(json.dumps('abc')))
check('incomplete-quote fixture 17', json.loads(json.dumps(solve('multipart/byteranges; x=a=b; boundary=ab'))), json.loads(json.dumps('ab')))
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
incomplete-quote fixture 0a;ba;bPassed
incomplete-quote fixture 1a"ba"bPassed
incomplete-quote fixture 2a\ba\bPassed
incomplete-quote fixture 3abcNoneFailed
incomplete-quote fixture 4abcabcPassed
incomplete-quote fixture 5NoneNonePassed
incomplete-quote fixture 6NoneNonePassed
incomplete-quote fixture 7NoneNonePassed
incomplete-quote fixture 8NoneNonePassed
incomplete-quote fixture 9abcdefghijklabcdefghijklPassed
incomplete-quote fixture 10NoneNonePassed
incomplete-quote fixture 11NoneNonePassed
incomplete-quote fixture 12NoneNonePassed
incomplete-quote fixture 13NoneNonePassed
incomplete-quote fixture 14NoneNonePassed
incomplete-quote fixture 15b1b1Passed
incomplete-quote fixture 16abcabcPassed
incomplete-quote fixture 17ababPassed

SHA-256 / 70c920c4a9c141b81e9689644c0b7db8c30d6cc3e6926b330cb1e8a7c162c121

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(x):
    parts=[]
    current=''
    quoted=False
    escaped=False
    for c in x:
        if escaped:
            current+=c
            escaped=False
        elif quoted and c=='\\':
            escaped=True
        elif c=='"':
            quoted=not quoted
        elif c==';' and not quoted:
            parts.append(current)
            current=''
        else:
            current+=c
    if quoted and escaped: return None
    parts.append(current)
    if parts[0].strip().lower()!='multipart/byteranges': return None
    boundaries=[]
    for part in parts[1:]:
        if '=' not in part: continue
        key,value=part.split('=',1)
        if key.strip().lower()=='boundary': boundaries.append(value.strip())
    if len(boundaries)!=1: return None
    value=boundaries[0]
    if not 1<=len(value)<=12: return None
    if any(ord(c)<32 or ord(c)>126 for c in value): return None
    return value
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('incomplete-quote fixture 0', json.loads(json.dumps(solve('multipart/byteranges; boundary="a;b"'))), json.loads(json.dumps('a;b')))
check('incomplete-quote fixture 1', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\"b"'))), json.loads(json.dumps('a"b')))
check('incomplete-quote fixture 2', json.loads(json.dumps(solve('multipart/byteranges; boundary="a\\\\b"'))), json.loads(json.dumps('a\\b')))
check('incomplete-quote fixture 3', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 4', json.loads(json.dumps(solve(' Multipart/ByteRanges ; BOUNDARY = abc '))), json.loads(json.dumps('abc')))
check('incomplete-quote fixture 5', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=a'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 6', json.loads(json.dumps(solve('multipart/byteranges; boundary=a; boundary=b'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 7', json.loads(json.dumps(solve('multipart/mixed; boundary=a'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 8', json.loads(json.dumps(solve('multipart/byteranges; boundary='))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 9', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijkl'))), json.loads(json.dumps('abcdefghijkl')))
check('incomplete-quote fixture 10', json.loads(json.dumps(solve('multipart/byteranges; boundary=abcdefghijklm'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 11', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\nb'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 12', json.loads(json.dumps(solve('multipart/byteranges; boundary=a\x7fb'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 13', json.loads(json.dumps(solve('multipart/byteranges; x=y'))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 14', json.loads(json.dumps(solve("p"*N))), json.loads(json.dumps(None)))
check('incomplete-quote fixture 15', json.loads(json.dumps(solve("multipart/byteranges; boundary=b"+str(N)))), json.loads(json.dumps("b"+str(N))))
check('incomplete-quote fixture 16', json.loads(json.dumps(solve('multipart/byteranges; boundary="abc"'))), json.loads(json.dumps('abc')))
check('incomplete-quote fixture 17', json.loads(json.dumps(solve('multipart/byteranges; x=a=b; boundary=ab'))), json.loads(json.dumps('ab')))
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
incomplete-quote fixture 0a;ba;bPassed
incomplete-quote fixture 1a"ba"bPassed
incomplete-quote fixture 2a\ba\bPassed
incomplete-quote fixture 3abcNoneFailed
incomplete-quote fixture 4abcabcPassed
incomplete-quote fixture 5NoneNonePassed
incomplete-quote fixture 6NoneNonePassed
incomplete-quote fixture 7NoneNonePassed
incomplete-quote fixture 8NoneNonePassed
incomplete-quote fixture 9abcdefghijklabcdefghijklPassed
incomplete-quote fixture 10NoneNonePassed
incomplete-quote fixture 11NoneNonePassed
incomplete-quote fixture 12NoneNonePassed
incomplete-quote fixture 13NoneNonePassed
incomplete-quote fixture 14NoneNonePassed
incomplete-quote fixture 15b1b1Passed
incomplete-quote fixture 16abcabcPassed
incomplete-quote fixture 17ababPassed

SHA-256 / a87a98db3475b198b6c53e4e509d47bc942b1b5bd1ddb27875a1e6ab06b695d0

HELD IN THE MEMBER ARCHIVE

The verified repair and its recorded checks are member-only.

This mechanism has 18 recorded checks per implementation. The open-access tier publishes the failure and the unsuccessful fix; the repaired source that passes every check, and the observations that prove it, are available to members.

Every case sharing this mechanism uses the same contract and the same repair, so this one record is held back for all of them.

Member access is invitation-based. Sign in with your invited account to inspect the repair.

Sign in to the archive ↗

Verification & scope

Deterministic simplified range service, with stipulated local policies and already parsed trusted inputs; not a complete HTTP implementation. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:41:19.674878+00:00.

Case digest / 4f2bacf71a6d8a0f6537e265a29a15b760483e45a0438cb4c138f73f99504972