FAILURE MAP
← Case archive

FA-27896 / HTTP redirects / Open access

Validate raw target text before any URL normalization: embedded tab · case 01

Only outer optional whitespace may be stripped.

Verified by executionVariant 1 · 6 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The embedded-tab decision uses 'False'; this violates the stipulated controller policy.

VERIFIED REPAIR

At this decision use "'\\t' in raw.strip(' \\t')", preserving the other controller outputs.

Unsuccessful approach: The partial repair uses "'\\t' in raw" and still fails an explicit boundary or control.

Case contract

Validate raw target text before any URL normalization. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.

Why this case matters

Models a redirect controller decision before following a target or exposing a redirect result.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, raw):
    return {'request': request, 'decision': ['\r' in raw or '\n' in raw, False, '\x00' in raw, bool(re.search(r'%(?![0-9A-Fa-f]{2})', raw)), '\\' in raw]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', '/a\rb\tc\x00d%G0\\e'), {'request': '/requests/' + str(N) + '/0', 'decision': [True, True, True, True, True]})
check('fixture 2', solve('/requests/' + str(N) + '/1', '\t/a%20b\t'), {'request': '/requests/' + str(N) + '/1', 'decision': [False, False, False, False, False]})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a\nb'), {'request': '/requests/' + str(N) + '/2', 'decision': [True, False, False, False, False]})
check('fixture 4', solve('/requests/' + str(N) + '/3', '/a%'), {'request': '/requests/' + str(N) + '/3', 'decision': [False, False, False, True, False]})
check('fixture 5', solve('/requests/' + str(N) + '/4', '/normal'), {'request': '/requests/' + str(N) + '/4', 'decision': [False, False, False, False, False]})
check('fixture 6', solve('/requests/' + str(N) + '/5', ''), {'request': '/requests/' + str(N) + '/5', 'decision': [False, False, False, False, False]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': [True, False, True, True, True], 'request': '/requests/1/0'}{'decision': [True, True, True, True, True], 'request': '/requests/1/0'}Failed
fixture 2{'decision': [False, False, False, False, False], 'request': '/requests/1/1'}{'decision': [False, False, False, False, False], 'request': '/requests/1/1'}Passed
fixture 3{'decision': [True, False, False, False, False], 'request': '/requests/1/2'}{'decision': [True, False, False, False, False], 'request': '/requests/1/2'}Passed
fixture 4{'decision': [False, False, False, True, False], 'request': '/requests/1/3'}{'decision': [False, False, False, True, False], 'request': '/requests/1/3'}Passed
fixture 5{'decision': [False, False, False, False, False], 'request': '/requests/1/4'}{'decision': [False, False, False, False, False], 'request': '/requests/1/4'}Passed
fixture 6{'decision': [False, False, False, False, False], 'request': '/requests/1/5'}{'decision': [False, False, False, False, False], 'request': '/requests/1/5'}Passed

SHA-256 / 274d8b7c4942c1227453050be54d096268be6768ea5028266b9fa100bd5a926e

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, raw):
    return {'request': request, 'decision': ['\r' in raw or '\n' in raw, '\t' in raw, '\x00' in raw, bool(re.search(r'%(?![0-9A-Fa-f]{2})', raw)), '\\' in raw]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', '/a\rb\tc\x00d%G0\\e'), {'request': '/requests/' + str(N) + '/0', 'decision': [True, True, True, True, True]})
check('fixture 2', solve('/requests/' + str(N) + '/1', '\t/a%20b\t'), {'request': '/requests/' + str(N) + '/1', 'decision': [False, False, False, False, False]})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a\nb'), {'request': '/requests/' + str(N) + '/2', 'decision': [True, False, False, False, False]})
check('fixture 4', solve('/requests/' + str(N) + '/3', '/a%'), {'request': '/requests/' + str(N) + '/3', 'decision': [False, False, False, True, False]})
check('fixture 5', solve('/requests/' + str(N) + '/4', '/normal'), {'request': '/requests/' + str(N) + '/4', 'decision': [False, False, False, False, False]})
check('fixture 6', solve('/requests/' + str(N) + '/5', ''), {'request': '/requests/' + str(N) + '/5', 'decision': [False, False, False, False, False]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': [True, True, True, True, True], 'request': '/requests/1/0'}{'decision': [True, True, True, True, True], 'request': '/requests/1/0'}Passed
fixture 2{'decision': [False, True, False, False, False], 'request': '/requests/1/1'}{'decision': [False, False, False, False, False], 'request': '/requests/1/1'}Failed
fixture 3{'decision': [True, False, False, False, False], 'request': '/requests/1/2'}{'decision': [True, False, False, False, False], 'request': '/requests/1/2'}Passed
fixture 4{'decision': [False, False, False, True, False], 'request': '/requests/1/3'}{'decision': [False, False, False, True, False], 'request': '/requests/1/3'}Passed
fixture 5{'decision': [False, False, False, False, False], 'request': '/requests/1/4'}{'decision': [False, False, False, False, False], 'request': '/requests/1/4'}Passed
fixture 6{'decision': [False, False, False, False, False], 'request': '/requests/1/5'}{'decision': [False, False, False, False, False], 'request': '/requests/1/5'}Passed

SHA-256 / 1117a21687b1d8ef72e41343e2383defd4dae64763d13468164ad6045322bfb4

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, raw):
    return {'request': request, 'decision': ['\r' in raw or '\n' in raw, '\t' in raw.strip(' \t'), '\x00' in raw, bool(re.search(r'%(?![0-9A-Fa-f]{2})', raw)), '\\' in raw]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', '/a\rb\tc\x00d%G0\\e'), {'request': '/requests/' + str(N) + '/0', 'decision': [True, True, True, True, True]})
check('fixture 2', solve('/requests/' + str(N) + '/1', '\t/a%20b\t'), {'request': '/requests/' + str(N) + '/1', 'decision': [False, False, False, False, False]})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a\nb'), {'request': '/requests/' + str(N) + '/2', 'decision': [True, False, False, False, False]})
check('fixture 4', solve('/requests/' + str(N) + '/3', '/a%'), {'request': '/requests/' + str(N) + '/3', 'decision': [False, False, False, True, False]})
check('fixture 5', solve('/requests/' + str(N) + '/4', '/normal'), {'request': '/requests/' + str(N) + '/4', 'decision': [False, False, False, False, False]})
check('fixture 6', solve('/requests/' + str(N) + '/5', ''), {'request': '/requests/' + str(N) + '/5', 'decision': [False, False, False, False, False]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': [True, True, True, True, True], 'request': '/requests/1/0'}{'decision': [True, True, True, True, True], 'request': '/requests/1/0'}Passed
fixture 2{'decision': [False, False, False, False, False], 'request': '/requests/1/1'}{'decision': [False, False, False, False, False], 'request': '/requests/1/1'}Passed
fixture 3{'decision': [True, False, False, False, False], 'request': '/requests/1/2'}{'decision': [True, False, False, False, False], 'request': '/requests/1/2'}Passed
fixture 4{'decision': [False, False, False, True, False], 'request': '/requests/1/3'}{'decision': [False, False, False, True, False], 'request': '/requests/1/3'}Passed
fixture 5{'decision': [False, False, False, False, False], 'request': '/requests/1/4'}{'decision': [False, False, False, False, False], 'request': '/requests/1/4'}Passed
fixture 6{'decision': [False, False, False, False, False], 'request': '/requests/1/5'}{'decision': [False, False, False, False, False], 'request': '/requests/1/5'}Passed

SHA-256 / 3788a590222f810d8e0c6e9edf5c7d7f80c1461c85ea2694df3c56077ede76eb

Verification & scope

Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:41:29.087269+00:00.

Case digest / 44382231d0ec40d8228fc5f82c098e8e07a6c0d5337b4008ba3414e9f798e782