FAILURE MAP
← Case archive

FA-28016 / HTTP redirects / Open access

Validate a redirect port against an explicit bounded port policy: omission default · case 01

Validate a redirect port against an explicit bounded port policy: the omission default branch emits an incorrect decision.

Verified by executionVariant 1 · 6 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The omission-default decision uses "port or (443 if scheme == 'https' else 80)"; this violates the stipulated controller policy.

VERIFIED REPAIR

At this decision use "(443 if scheme == 'https' else 80) if port is None else port", preserving the other controller outputs.

Unsuccessful approach: The partial repair uses 'port if port is not None else 80' and still fails an explicit boundary or control.

Case contract

Validate a redirect port against an explicit bounded port policy. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.

Why this case matters

Models a redirect controller decision before following a target or exposing a redirect result.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, port, scheme, permitted):
    return {'request': request, 'decision': [port or (443 if scheme == 'https' else 80), port == 0, port is not None and port > 65535, port is not None and port < 0, port is None or port in permitted]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', None, 'https', [443]), {'request': '/requests/' + str(N) + '/0', 'decision': [443, False, False, False, True]})
check('fixture 2', solve('/requests/' + str(N) + '/1', 0, 'https', [443]), {'request': '/requests/' + str(N) + '/1', 'decision': [0, True, False, False, False]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 65535, 'http', [65535]), {'request': '/requests/' + str(N) + '/2', 'decision': [65535, False, False, False, True]})
check('fixture 4', solve('/requests/' + str(N) + '/3', 65536, 'http', [80]), {'request': '/requests/' + str(N) + '/3', 'decision': [65536, False, True, False, False]})
check('fixture 5', solve('/requests/' + str(N) + '/4', -1, 'http', [-1]), {'request': '/requests/' + str(N) + '/4', 'decision': [-1, False, False, True, True]})
check('fixture 6', solve('/requests/' + str(N) + '/5', 8443, 'https', [8443]), {'request': '/requests/' + str(N) + '/5', 'decision': [8443, False, False, False, True]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': [443, False, False, False, True], 'request': '/requests/1/0'}{'decision': [443, False, False, False, True], 'request': '/requests/1/0'}Passed
fixture 2{'decision': [443, True, False, False, False], 'request': '/requests/1/1'}{'decision': [0, True, False, False, False], 'request': '/requests/1/1'}Failed
fixture 3{'decision': [65535, False, False, False, True], 'request': '/requests/1/2'}{'decision': [65535, False, False, False, True], 'request': '/requests/1/2'}Passed
fixture 4{'decision': [65536, False, True, False, False], 'request': '/requests/1/3'}{'decision': [65536, False, True, False, False], 'request': '/requests/1/3'}Passed
fixture 5{'decision': [-1, False, False, True, True], 'request': '/requests/1/4'}{'decision': [-1, False, False, True, True], 'request': '/requests/1/4'}Passed
fixture 6{'decision': [8443, False, False, False, True], 'request': '/requests/1/5'}{'decision': [8443, False, False, False, True], 'request': '/requests/1/5'}Passed

SHA-256 / a9e5bc33fa0e383216e185f8d9b99ffaf433eae25063bf6655aa30866babbeb8

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, port, scheme, permitted):
    return {'request': request, 'decision': [port if port is not None else 80, port == 0, port is not None and port > 65535, port is not None and port < 0, port is None or port in permitted]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', None, 'https', [443]), {'request': '/requests/' + str(N) + '/0', 'decision': [443, False, False, False, True]})
check('fixture 2', solve('/requests/' + str(N) + '/1', 0, 'https', [443]), {'request': '/requests/' + str(N) + '/1', 'decision': [0, True, False, False, False]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 65535, 'http', [65535]), {'request': '/requests/' + str(N) + '/2', 'decision': [65535, False, False, False, True]})
check('fixture 4', solve('/requests/' + str(N) + '/3', 65536, 'http', [80]), {'request': '/requests/' + str(N) + '/3', 'decision': [65536, False, True, False, False]})
check('fixture 5', solve('/requests/' + str(N) + '/4', -1, 'http', [-1]), {'request': '/requests/' + str(N) + '/4', 'decision': [-1, False, False, True, True]})
check('fixture 6', solve('/requests/' + str(N) + '/5', 8443, 'https', [8443]), {'request': '/requests/' + str(N) + '/5', 'decision': [8443, False, False, False, True]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': [80, False, False, False, True], 'request': '/requests/1/0'}{'decision': [443, False, False, False, True], 'request': '/requests/1/0'}Failed
fixture 2{'decision': [0, True, False, False, False], 'request': '/requests/1/1'}{'decision': [0, True, False, False, False], 'request': '/requests/1/1'}Passed
fixture 3{'decision': [65535, False, False, False, True], 'request': '/requests/1/2'}{'decision': [65535, False, False, False, True], 'request': '/requests/1/2'}Passed
fixture 4{'decision': [65536, False, True, False, False], 'request': '/requests/1/3'}{'decision': [65536, False, True, False, False], 'request': '/requests/1/3'}Passed
fixture 5{'decision': [-1, False, False, True, True], 'request': '/requests/1/4'}{'decision': [-1, False, False, True, True], 'request': '/requests/1/4'}Passed
fixture 6{'decision': [8443, False, False, False, True], 'request': '/requests/1/5'}{'decision': [8443, False, False, False, True], 'request': '/requests/1/5'}Passed

SHA-256 / c536a52b91c1ff879480c66da78ada560b580d76b119ca83095b6903609a61d9

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, port, scheme, permitted):
    return {'request': request, 'decision': [(443 if scheme == 'https' else 80) if port is None else port, port == 0, port is not None and port > 65535, port is not None and port < 0, port is None or port in permitted]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', None, 'https', [443]), {'request': '/requests/' + str(N) + '/0', 'decision': [443, False, False, False, True]})
check('fixture 2', solve('/requests/' + str(N) + '/1', 0, 'https', [443]), {'request': '/requests/' + str(N) + '/1', 'decision': [0, True, False, False, False]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 65535, 'http', [65535]), {'request': '/requests/' + str(N) + '/2', 'decision': [65535, False, False, False, True]})
check('fixture 4', solve('/requests/' + str(N) + '/3', 65536, 'http', [80]), {'request': '/requests/' + str(N) + '/3', 'decision': [65536, False, True, False, False]})
check('fixture 5', solve('/requests/' + str(N) + '/4', -1, 'http', [-1]), {'request': '/requests/' + str(N) + '/4', 'decision': [-1, False, False, True, True]})
check('fixture 6', solve('/requests/' + str(N) + '/5', 8443, 'https', [8443]), {'request': '/requests/' + str(N) + '/5', 'decision': [8443, False, False, False, True]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': [443, False, False, False, True], 'request': '/requests/1/0'}{'decision': [443, False, False, False, True], 'request': '/requests/1/0'}Passed
fixture 2{'decision': [0, True, False, False, False], 'request': '/requests/1/1'}{'decision': [0, True, False, False, False], 'request': '/requests/1/1'}Passed
fixture 3{'decision': [65535, False, False, False, True], 'request': '/requests/1/2'}{'decision': [65535, False, False, False, True], 'request': '/requests/1/2'}Passed
fixture 4{'decision': [65536, False, True, False, False], 'request': '/requests/1/3'}{'decision': [65536, False, True, False, False], 'request': '/requests/1/3'}Passed
fixture 5{'decision': [-1, False, False, True, True], 'request': '/requests/1/4'}{'decision': [-1, False, False, True, True], 'request': '/requests/1/4'}Passed
fixture 6{'decision': [8443, False, False, False, True], 'request': '/requests/1/5'}{'decision': [8443, False, False, False, True], 'request': '/requests/1/5'}Passed

SHA-256 / 40385b168fc8301191803d371b1bd794b479241f9e2f2b8b6b79766715de2a09

Verification & scope

Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:41:30.197276+00:00.

Case digest / 3366ec1feba8ee598f296a3f6840047182de81bc09b82ff731b04e8d4828cf77