FA-28041 / HTTP redirects / Open access
Keep encoded path structure distinct from redirect routing structure: encoded slash preservation · case 01
Keep encoded path structure distinct from redirect routing structure: the encoded slash preservation branch emits an incorrect decision.
ROOT CAUSE
The encoded-slash-preservation decision uses "unquote(path).split('/')"; this violates the stipulated controller policy.
VERIFIED REPAIR
At this decision use "path.split('/')", preserving the other controller outputs.
Unsuccessful approach: The partial repair uses "path.replace('%2F','/').split('/')" and still fails an explicit boundary or control.
Case contract
Keep encoded path structure distinct from redirect routing structure. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.
Why this case matters
Models a redirect controller decision before following a target or exposing a redirect result.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, path):
return {'request': request, 'decision': [unquote(path).split('/'), path.partition('?')[0], path.replace('%20',' '), unquote(path), [p for p in path.split('/') if p in ('.','..')]]}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', '/a%2Fb/%252F'), {'request': '/requests/' + str(N) + '/0', 'decision': [['', 'a%2Fb', '%252F'], '/a%2Fb/%252F', '/a%2Fb/%252F', '/a/b/%2F', []]})
check('fixture 2', solve('/requests/' + str(N) + '/1', '/a+b/c%20d'), {'request': '/requests/' + str(N) + '/1', 'decision': [['', 'a+b', 'c%20d'], '/a+b/c%20d', '/a+b/c d', '/a+b/c d', []]})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a?x=1'), {'request': '/requests/' + str(N) + '/2', 'decision': [['', 'a?x=1'], '/a', '/a?x=1', '/a?x=1', []]})
check('fixture 4', solve('/requests/' + str(N) + '/3', '/x/../y/./z'), {'request': '/requests/' + str(N) + '/3', 'decision': [['', 'x', '..', 'y', '.', 'z'], '/x/../y/./z', '/x/../y/./z', '/x/../y/./z', ['..', '.']]})
check('fixture 5', solve('/requests/' + str(N) + '/4', '/v1.2/%2e%2e/a'), {'request': '/requests/' + str(N) + '/4', 'decision': [['', 'v1.2', '%2e%2e', 'a'], '/v1.2/%2e%2e/a', '/v1.2/%2e%2e/a', '/v1.2/../a', []]})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/'), {'request': '/requests/' + str(N) + '/5', 'decision': [['', ''], '/', '/', '/', []]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': [['', 'a', 'b', '%2F'], '/a%2Fb/%252F', '/a%2Fb/%252F', '/a/b/%2F', []], 'request': '/requests/1/0'} | {'decision': [['', 'a%2Fb', '%252F'], '/a%2Fb/%252F', '/a%2Fb/%252F', '/a/b/%2F', []], 'request': '/requests/1/0'} | Failed |
| fixture 2 | {'decision': [['', 'a+b', 'c d'], '/a+b/c%20d', '/a+b/c d', '/a+b/c d', []], 'request': '/requests/1/1'} | {'decision': [['', 'a+b', 'c%20d'], '/a+b/c%20d', '/a+b/c d', '/a+b/c d', []], 'request': '/requests/1/1'} | Failed |
| fixture 3 | {'decision': [['', 'a?x=1'], '/a', '/a?x=1', '/a?x=1', []], 'request': '/requests/1/2'} | {'decision': [['', 'a?x=1'], '/a', '/a?x=1', '/a?x=1', []], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': [['', 'x', '..', 'y', '.', 'z'], '/x/../y/./z', '/x/../y/./z', '/x/../y/./z', ['..', '.']], 'request': '/requests/1/3'} | {'decision': [['', 'x', '..', 'y', '.', 'z'], '/x/../y/./z', '/x/../y/./z', '/x/../y/./z', ['..', '.']], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': [['', 'v1.2', '..', 'a'], '/v1.2/%2e%2e/a', '/v1.2/%2e%2e/a', '/v1.2/../a', []], 'request': '/requests/1/4'} | {'decision': [['', 'v1.2', '%2e%2e', 'a'], '/v1.2/%2e%2e/a', '/v1.2/%2e%2e/a', '/v1.2/../a', []], 'request': '/requests/1/4'} | Failed |
| fixture 6 | {'decision': [['', ''], '/', '/', '/', []], 'request': '/requests/1/5'} | {'decision': [['', ''], '/', '/', '/', []], 'request': '/requests/1/5'} | Passed |
SHA-256 / 64419bb07d03f2760eb537779abf9e43d18ad53037cb8864d6a4da1c62b642ce
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, path):
return {'request': request, 'decision': [path.replace('%2F','/').split('/'), path.partition('?')[0], path.replace('%20',' '), unquote(path), [p for p in path.split('/') if p in ('.','..')]]}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', '/a%2Fb/%252F'), {'request': '/requests/' + str(N) + '/0', 'decision': [['', 'a%2Fb', '%252F'], '/a%2Fb/%252F', '/a%2Fb/%252F', '/a/b/%2F', []]})
check('fixture 2', solve('/requests/' + str(N) + '/1', '/a+b/c%20d'), {'request': '/requests/' + str(N) + '/1', 'decision': [['', 'a+b', 'c%20d'], '/a+b/c%20d', '/a+b/c d', '/a+b/c d', []]})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a?x=1'), {'request': '/requests/' + str(N) + '/2', 'decision': [['', 'a?x=1'], '/a', '/a?x=1', '/a?x=1', []]})
check('fixture 4', solve('/requests/' + str(N) + '/3', '/x/../y/./z'), {'request': '/requests/' + str(N) + '/3', 'decision': [['', 'x', '..', 'y', '.', 'z'], '/x/../y/./z', '/x/../y/./z', '/x/../y/./z', ['..', '.']]})
check('fixture 5', solve('/requests/' + str(N) + '/4', '/v1.2/%2e%2e/a'), {'request': '/requests/' + str(N) + '/4', 'decision': [['', 'v1.2', '%2e%2e', 'a'], '/v1.2/%2e%2e/a', '/v1.2/%2e%2e/a', '/v1.2/../a', []]})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/'), {'request': '/requests/' + str(N) + '/5', 'decision': [['', ''], '/', '/', '/', []]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': [['', 'a', 'b', '%252F'], '/a%2Fb/%252F', '/a%2Fb/%252F', '/a/b/%2F', []], 'request': '/requests/1/0'} | {'decision': [['', 'a%2Fb', '%252F'], '/a%2Fb/%252F', '/a%2Fb/%252F', '/a/b/%2F', []], 'request': '/requests/1/0'} | Failed |
| fixture 2 | {'decision': [['', 'a+b', 'c%20d'], '/a+b/c%20d', '/a+b/c d', '/a+b/c d', []], 'request': '/requests/1/1'} | {'decision': [['', 'a+b', 'c%20d'], '/a+b/c%20d', '/a+b/c d', '/a+b/c d', []], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': [['', 'a?x=1'], '/a', '/a?x=1', '/a?x=1', []], 'request': '/requests/1/2'} | {'decision': [['', 'a?x=1'], '/a', '/a?x=1', '/a?x=1', []], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': [['', 'x', '..', 'y', '.', 'z'], '/x/../y/./z', '/x/../y/./z', '/x/../y/./z', ['..', '.']], 'request': '/requests/1/3'} | {'decision': [['', 'x', '..', 'y', '.', 'z'], '/x/../y/./z', '/x/../y/./z', '/x/../y/./z', ['..', '.']], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': [['', 'v1.2', '%2e%2e', 'a'], '/v1.2/%2e%2e/a', '/v1.2/%2e%2e/a', '/v1.2/../a', []], 'request': '/requests/1/4'} | {'decision': [['', 'v1.2', '%2e%2e', 'a'], '/v1.2/%2e%2e/a', '/v1.2/%2e%2e/a', '/v1.2/../a', []], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': [['', ''], '/', '/', '/', []], 'request': '/requests/1/5'} | {'decision': [['', ''], '/', '/', '/', []], 'request': '/requests/1/5'} | Passed |
SHA-256 / a20364d9666d06e5fd268a77862b3ffc9d09e428b4c531283a5f8c993cacafc8
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, path):
return {'request': request, 'decision': [path.split('/'), path.partition('?')[0], path.replace('%20',' '), unquote(path), [p for p in path.split('/') if p in ('.','..')]]}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', '/a%2Fb/%252F'), {'request': '/requests/' + str(N) + '/0', 'decision': [['', 'a%2Fb', '%252F'], '/a%2Fb/%252F', '/a%2Fb/%252F', '/a/b/%2F', []]})
check('fixture 2', solve('/requests/' + str(N) + '/1', '/a+b/c%20d'), {'request': '/requests/' + str(N) + '/1', 'decision': [['', 'a+b', 'c%20d'], '/a+b/c%20d', '/a+b/c d', '/a+b/c d', []]})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/a?x=1'), {'request': '/requests/' + str(N) + '/2', 'decision': [['', 'a?x=1'], '/a', '/a?x=1', '/a?x=1', []]})
check('fixture 4', solve('/requests/' + str(N) + '/3', '/x/../y/./z'), {'request': '/requests/' + str(N) + '/3', 'decision': [['', 'x', '..', 'y', '.', 'z'], '/x/../y/./z', '/x/../y/./z', '/x/../y/./z', ['..', '.']]})
check('fixture 5', solve('/requests/' + str(N) + '/4', '/v1.2/%2e%2e/a'), {'request': '/requests/' + str(N) + '/4', 'decision': [['', 'v1.2', '%2e%2e', 'a'], '/v1.2/%2e%2e/a', '/v1.2/%2e%2e/a', '/v1.2/../a', []]})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/'), {'request': '/requests/' + str(N) + '/5', 'decision': [['', ''], '/', '/', '/', []]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': [['', 'a%2Fb', '%252F'], '/a%2Fb/%252F', '/a%2Fb/%252F', '/a/b/%2F', []], 'request': '/requests/1/0'} | {'decision': [['', 'a%2Fb', '%252F'], '/a%2Fb/%252F', '/a%2Fb/%252F', '/a/b/%2F', []], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': [['', 'a+b', 'c%20d'], '/a+b/c%20d', '/a+b/c d', '/a+b/c d', []], 'request': '/requests/1/1'} | {'decision': [['', 'a+b', 'c%20d'], '/a+b/c%20d', '/a+b/c d', '/a+b/c d', []], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': [['', 'a?x=1'], '/a', '/a?x=1', '/a?x=1', []], 'request': '/requests/1/2'} | {'decision': [['', 'a?x=1'], '/a', '/a?x=1', '/a?x=1', []], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': [['', 'x', '..', 'y', '.', 'z'], '/x/../y/./z', '/x/../y/./z', '/x/../y/./z', ['..', '.']], 'request': '/requests/1/3'} | {'decision': [['', 'x', '..', 'y', '.', 'z'], '/x/../y/./z', '/x/../y/./z', '/x/../y/./z', ['..', '.']], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': [['', 'v1.2', '%2e%2e', 'a'], '/v1.2/%2e%2e/a', '/v1.2/%2e%2e/a', '/v1.2/../a', []], 'request': '/requests/1/4'} | {'decision': [['', 'v1.2', '%2e%2e', 'a'], '/v1.2/%2e%2e/a', '/v1.2/%2e%2e/a', '/v1.2/../a', []], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': [['', ''], '/', '/', '/', []], 'request': '/requests/1/5'} | {'decision': [['', ''], '/', '/', '/', []], 'request': '/requests/1/5'} | Passed |
SHA-256 / 788120f024b2a34950b3dfef6621e779ac2109d0dba4a5ac1a15abb6b8257926
Verification & scope
Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:41:30.449744+00:00.
Case digest / 74eca1d8ffc0c7340bd69c491a74357e7537d62b6e6038fe6feba54c556b18e8