FAILURE MAP
← Case archive

FA-28551 / HTTP redirects / Open access

Evaluate configured destination-host permissions with label boundaries: subdomain option · case 01

Evaluate configured destination-host permissions with label boundaries: the subdomain option branch emits an incorrect decision.

Verified by executionVariant 1 · 7 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The subdomain-option decision uses "any(host.lower().rstrip('.').endswith(a) for a in allowed)"; this violates the stipulated controller policy.

VERIFIED REPAIR

At this decision use "any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed)", preserving the other controller outputs.

Unsuccessful approach: The partial repair uses "host.lower().rstrip('.') in allowed" and still fails an explicit boundary or control.

Case contract

Evaluate configured destination-host permissions with label boundaries. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.

Why this case matters

Models a redirect controller decision before following a target or exposing a redirect result.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, host, allowed, subdomains, source_host, blocked):
    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.').endswith(a) for a in allowed), host.lower().rstrip('.') not in blocked, bool(allowed), len(host.rstrip('.').split('.')), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [x for x in blocked if x == host.lower().rstrip('.') ], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})
check('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})
check('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})
check('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})
check('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': ['evil-example.test', False, True, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}Failed
fixture 3{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': ['a.b.example.test', True, True, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}Failed
fixture 6{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}Passed
fixture 7{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}Passed

SHA-256 / 4378519f21bb8bf498b13424618d29300c665492eff6d8648737a14861e6d814

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, host, allowed, subdomains, source_host, blocked):
    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), host.lower().rstrip('.') in allowed, host.lower().rstrip('.') not in blocked, bool(allowed), len(host.rstrip('.').split('.')), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [x for x in blocked if x == host.lower().rstrip('.') ], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})
check('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})
check('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})
check('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})
check('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': ['api.example.test', True, False, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}Failed
fixture 2{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}Passed
fixture 3{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}Passed
fixture 7{'decision': ['example.example.test', True, False, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}Failed

SHA-256 / 4a77c9632e960075a32807fa85a2e93fcb7e231f04dd9763fa28cb0adf6fc954

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, host, allowed, subdomains, source_host, blocked):
    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed), host.lower().rstrip('.') not in blocked, bool(allowed), len(host.rstrip('.').split('.')), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [x for x in blocked if x == host.lower().rstrip('.') ], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})
check('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})
check('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})
check('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})
check('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}Passed
fixture 3{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}Passed
fixture 7{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}Passed

SHA-256 / 22d2b1004460ff2e2da1080290f1376d7556f07fc05c0702d9057aa40bbdea41

Verification & scope

Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:41:34.996448+00:00.

Case digest / 49a4c8950721678c586d3ee30547f91b0f5756f5e0966d6054449e642f6fc4c7