FAILURE MAP
← Case archive

FA-28001 / HTTP redirects / Open access

Reject malformed redirect authorities without interpreting path text as an authority: network path host · case 01

Reject malformed redirect authorities without interpreting path text as an authority: the network path host branch emits an incorrect decision.

Verified by executionVariant 1 · 6 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The network-path-host decision uses 'True'; this violates the stipulated controller policy.

VERIFIED REPAIR

At this decision use "not target.startswith('//') or bool(urlsplit(target).netloc)", preserving the other controller outputs.

Unsuccessful approach: The partial repair uses 'bool(urlsplit(target).scheme)' and still fails an explicit boundary or control.

Case contract

Reject malformed redirect authorities without interpreting path text as an authority. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.

Why this case matters

Models a redirect controller decision before following a target or exposing a redirect result.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, target):
    return {'request': request, 'decision': [target.startswith('//') or '://' in target, urlsplit(target).hostname or '', True, urlsplit(target).path, urlsplit(target).path or '/']} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'https://EXAMPLE.test:8443/A'), {'request': '/requests/' + str(N) + '/0', 'decision': [True, 'example.test', True, '/A', '/A']})
check('fixture 2', solve('/requests/' + str(N) + '/1', '//other.test/B'), {'request': '/requests/' + str(N) + '/1', 'decision': [True, 'other.test', True, '/B', '/B']})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a//b'), {'request': '/requests/' + str(N) + '/2', 'decision': [False, '', True, '/a//b', '/a//b']})
check('fixture 4', solve('/requests/' + str(N) + '/3', '///missing'), {'request': '/requests/' + str(N) + '/3', 'decision': [True, '', False, '/missing', '/missing']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'https://h.test'), {'request': '/requests/' + str(N) + '/4', 'decision': [True, 'h.test', True, '', '/']})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/MiXeD?q=x'), {'request': '/requests/' + str(N) + '/5', 'decision': [False, '', True, '/MiXeD', '/MiXeD']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'}{'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'}{'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'}Passed
fixture 3{'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'}{'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': [True, '', True, '/missing', '/missing'], 'request': '/requests/1/3'}{'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'}Failed
fixture 5{'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'}{'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'}{'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'}Passed

SHA-256 / dfa8fa7d150758c5e5c65129a9805ba90f783084db022d2005d04557cf62165c

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, target):
    return {'request': request, 'decision': [target.startswith('//') or '://' in target, urlsplit(target).hostname or '', bool(urlsplit(target).scheme), urlsplit(target).path, urlsplit(target).path or '/']} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'https://EXAMPLE.test:8443/A'), {'request': '/requests/' + str(N) + '/0', 'decision': [True, 'example.test', True, '/A', '/A']})
check('fixture 2', solve('/requests/' + str(N) + '/1', '//other.test/B'), {'request': '/requests/' + str(N) + '/1', 'decision': [True, 'other.test', True, '/B', '/B']})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a//b'), {'request': '/requests/' + str(N) + '/2', 'decision': [False, '', True, '/a//b', '/a//b']})
check('fixture 4', solve('/requests/' + str(N) + '/3', '///missing'), {'request': '/requests/' + str(N) + '/3', 'decision': [True, '', False, '/missing', '/missing']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'https://h.test'), {'request': '/requests/' + str(N) + '/4', 'decision': [True, 'h.test', True, '', '/']})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/MiXeD?q=x'), {'request': '/requests/' + str(N) + '/5', 'decision': [False, '', True, '/MiXeD', '/MiXeD']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'}{'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': [True, 'other.test', False, '/B', '/B'], 'request': '/requests/1/1'}{'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'}Failed
fixture 3{'decision': [False, '', False, '/a//b', '/a//b'], 'request': '/requests/1/2'}{'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'}Failed
fixture 4{'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'}{'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'}{'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': [False, '', False, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'}{'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'}Failed

SHA-256 / a99bd334cce922e7ce4f2d9c477ec77dba6aabdadd924b08170276d703b3c0ac

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, target):
    return {'request': request, 'decision': [target.startswith('//') or '://' in target, urlsplit(target).hostname or '', not target.startswith('//') or bool(urlsplit(target).netloc), urlsplit(target).path, urlsplit(target).path or '/']} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'https://EXAMPLE.test:8443/A'), {'request': '/requests/' + str(N) + '/0', 'decision': [True, 'example.test', True, '/A', '/A']})
check('fixture 2', solve('/requests/' + str(N) + '/1', '//other.test/B'), {'request': '/requests/' + str(N) + '/1', 'decision': [True, 'other.test', True, '/B', '/B']})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a//b'), {'request': '/requests/' + str(N) + '/2', 'decision': [False, '', True, '/a//b', '/a//b']})
check('fixture 4', solve('/requests/' + str(N) + '/3', '///missing'), {'request': '/requests/' + str(N) + '/3', 'decision': [True, '', False, '/missing', '/missing']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'https://h.test'), {'request': '/requests/' + str(N) + '/4', 'decision': [True, 'h.test', True, '', '/']})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/MiXeD?q=x'), {'request': '/requests/' + str(N) + '/5', 'decision': [False, '', True, '/MiXeD', '/MiXeD']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'}{'decision': [True, 'example.test', True, '/A', '/A'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'}{'decision': [True, 'other.test', True, '/B', '/B'], 'request': '/requests/1/1'}Passed
fixture 3{'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'}{'decision': [False, '', True, '/a//b', '/a//b'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'}{'decision': [True, '', False, '/missing', '/missing'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'}{'decision': [True, 'h.test', True, '', '/'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'}{'decision': [False, '', True, '/MiXeD', '/MiXeD'], 'request': '/requests/1/5'}Passed

SHA-256 / dd045afe69a6c88b5e35bf639a7121ea72cf104c9f24f0d3fe88bd5f7b85ee37

Verification & scope

Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:41:30.114901+00:00.

Case digest / 228c18c1449078fe3a7c5a1379e6f35d5c00da3293ddfb5d04fa9a8ba8ddd608