FA-27991 / HTTP redirects / Open access
Reject malformed redirect authorities without interpreting path text as an authority: authority presence · case 01
Reject malformed redirect authorities without interpreting path text as an authority: the authority presence branch emits an incorrect decision.
ROOT CAUSE
The authority-presence decision uses "'//' in target"; this violates the stipulated controller policy.
VERIFIED REPAIR
At this decision use "target.startswith('//') or '://' in target", preserving the other controller outputs.
Unsuccessful approach: The partial repair uses "'://' in target" and still fails an explicit boundary or control.
Case contract
Reject malformed redirect authorities without interpreting path text as an authority. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.
Why this case matters
Models a redirect controller decision before following a target or exposing a redirect result.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, target):
return {'request': request, 'decision': ['//' in target, urlsplit(target).hostname or '', not target.startswith('//') or bool(urlsplit(target).netloc), urlsplit(target).path, urlsplit(target).path or '/']}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'https://EXAMPLE.test:8443/A'), {'request': '/requests/' + str(N) + '/0', 'decision': [True, 'example.test', True, '/A', '/A']})
check('fixture 2', solve('/requests/' + str(N) + '/1', '//other.test/B'), {'request': '/requests/' + str(N) + '/1', 'decision': [True, 'other.test', True, '/B', '/B']})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a//b'), {'request': '/requests/' + str(N) + '/2', 'decision': [False, '', True, '/a//b', '/a//b']})
check('fixture 4', solve('/requests/' + str(N) + '/3', '///missing'), {'request': '/requests/' + str(N) + '/3', 'decision': [True, '', False, '/missing', '/missing']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'https://h.test'), {'request': '/requests/' + str(N) + '/4', 'decision': [True, 'h.test', True, '', '/']})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/MiXeD?q=x'), {'request': '/requests/' + str(N) + '/5', 'decision': [False, '', True, '/MiXeD', '/MiXeD']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'} | {'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'} | {'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': [True, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'} | {'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'} | Failed |
| fixture 4 | {'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'} | {'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'} | {'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'} | {'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'} | Passed |
SHA-256 / bf17e4aa862bb680a78fd33b648a80f246b71f25b8c9112440ef3b0f62a3700a
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, target):
return {'request': request, 'decision': ['://' in target, urlsplit(target).hostname or '', not target.startswith('//') or bool(urlsplit(target).netloc), urlsplit(target).path, urlsplit(target).path or '/']}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'https://EXAMPLE.test:8443/A'), {'request': '/requests/' + str(N) + '/0', 'decision': [True, 'example.test', True, '/A', '/A']})
check('fixture 2', solve('/requests/' + str(N) + '/1', '//other.test/B'), {'request': '/requests/' + str(N) + '/1', 'decision': [True, 'other.test', True, '/B', '/B']})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a//b'), {'request': '/requests/' + str(N) + '/2', 'decision': [False, '', True, '/a//b', '/a//b']})
check('fixture 4', solve('/requests/' + str(N) + '/3', '///missing'), {'request': '/requests/' + str(N) + '/3', 'decision': [True, '', False, '/missing', '/missing']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'https://h.test'), {'request': '/requests/' + str(N) + '/4', 'decision': [True, 'h.test', True, '', '/']})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/MiXeD?q=x'), {'request': '/requests/' + str(N) + '/5', 'decision': [False, '', True, '/MiXeD', '/MiXeD']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'} | {'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': [False, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'} | {'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'} | Failed |
| fixture 3 | {'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'} | {'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': [False, '', False, '/missing', '/missing'], 'request': '/requests/1/3'} | {'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'} | Failed |
| fixture 5 | {'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'} | {'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'} | {'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'} | Passed |
SHA-256 / 8b1a149e1e1aa66c8b842132ecbf8941c219e9ca1ca147a1fab8b609b2abe3f6
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, target):
return {'request': request, 'decision': [target.startswith('//') or '://' in target, urlsplit(target).hostname or '', not target.startswith('//') or bool(urlsplit(target).netloc), urlsplit(target).path, urlsplit(target).path or '/']}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'https://EXAMPLE.test:8443/A'), {'request': '/requests/' + str(N) + '/0', 'decision': [True, 'example.test', True, '/A', '/A']})
check('fixture 2', solve('/requests/' + str(N) + '/1', '//other.test/B'), {'request': '/requests/' + str(N) + '/1', 'decision': [True, 'other.test', True, '/B', '/B']})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a//b'), {'request': '/requests/' + str(N) + '/2', 'decision': [False, '', True, '/a//b', '/a//b']})
check('fixture 4', solve('/requests/' + str(N) + '/3', '///missing'), {'request': '/requests/' + str(N) + '/3', 'decision': [True, '', False, '/missing', '/missing']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'https://h.test'), {'request': '/requests/' + str(N) + '/4', 'decision': [True, 'h.test', True, '', '/']})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/MiXeD?q=x'), {'request': '/requests/' + str(N) + '/5', 'decision': [False, '', True, '/MiXeD', '/MiXeD']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'} | {'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'} | {'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'} | {'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'} | {'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'} | {'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'} | {'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'} | Passed |
SHA-256 / dd045afe69a6c88b5e35bf639a7121ea72cf104c9f24f0d3fe88bd5f7b85ee37
Verification & scope
Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:41:30.074295+00:00.
Case digest / 53b47a1e36b31cf15d2b184a409b1e1f9096f0656d617bc15797e6322ea6641f