FAILURE MAP
← Case archive

FA-28561 / HTTP redirects / Open access

Evaluate configured destination-host permissions with label boundaries: empty allowlist denies · case 01

Evaluate configured destination-host permissions with label boundaries: the empty allowlist denies branch emits an incorrect decision.

Verified by executionVariant 1 · 7 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The empty-allowlist-denies decision uses 'True'; this violates the stipulated controller policy.

VERIFIED REPAIR

At this decision use 'bool(allowed)', preserving the other controller outputs.

Unsuccessful approach: The partial repair uses 'bool(blocked)' and still fails an explicit boundary or control.

Case contract

Evaluate configured destination-host permissions with label boundaries. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.

Why this case matters

Models a redirect controller decision before following a target or exposing a redirect result.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, host, allowed, subdomains, source_host, blocked):
    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed), host.lower().rstrip('.') not in blocked, True, len(host.rstrip('.').split('.')), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [x for x in blocked if x == host.lower().rstrip('.') ], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})
check('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})
check('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})
check('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})
check('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}Passed
fixture 3{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': ['other.test', False, False, True, True, 2, True, ['test'], [], None], 'request': '/requests/1/5'}{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}Failed
fixture 7{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}Passed

SHA-256 / dac16aa0c0137d0ceba02dc3f41d2a46ca292196ee4e52eef0f2a9851392a5c2

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, host, allowed, subdomains, source_host, blocked):
    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed), host.lower().rstrip('.') not in blocked, bool(blocked), len(host.rstrip('.').split('.')), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [x for x in blocked if x == host.lower().rstrip('.') ], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})
check('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})
check('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})
check('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})
check('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': ['api.example.test', True, True, True, False, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}Failed
fixture 2{'decision': ['evil-example.test', False, False, True, False, 2, False, ['test'], [], None], 'request': '/requests/1/1'}{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}Failed
fixture 3{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': ['example.test', True, True, True, False, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}Failed
fixture 5{'decision': ['a.b.example.test', True, False, True, False, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}Failed
fixture 6{'decision': ['other.test', False, False, True, True, 2, True, ['test'], [], None], 'request': '/requests/1/5'}{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}Failed
fixture 7{'decision': ['example.example.test', True, True, True, False, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}Failed

SHA-256 / 9447fc7845eac5b442465617503e46c4d0889081c15127167ded0710b01d384c

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, host, allowed, subdomains, source_host, blocked):
    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed), host.lower().rstrip('.') not in blocked, bool(allowed), len(host.rstrip('.').split('.')), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [x for x in blocked if x == host.lower().rstrip('.') ], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})
check('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})
check('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})
check('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})
check('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}Passed
fixture 3{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}Passed
fixture 7{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}Passed

SHA-256 / 22d2b1004460ff2e2da1080290f1376d7556f07fc05c0702d9057aa40bbdea41

Verification & scope

Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:41:35.045726+00:00.

Case digest / 7f9f092d45cf954adc055972012e08bcfcbf3cdcb5d04146002677de89887b4f