FAILURE MAP
← Case archive

FA-28581 / HTTP redirects / Open access

Evaluate configured destination-host permissions with label boundaries: explicit block report · case 01

Evaluate configured destination-host permissions with label boundaries: the explicit block report branch emits an incorrect decision.

Verified by executionVariant 1 · 7 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The explicit-block-report decision uses 'blocked'; this violates the stipulated controller policy.

VERIFIED REPAIR

At this decision use "[x for x in blocked if x == host.lower().rstrip('.') ]", preserving the other controller outputs.

Unsuccessful approach: The partial repair uses '[]' and still fails an explicit boundary or control.

Case contract

Evaluate configured destination-host permissions with label boundaries. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.

Why this case matters

Models a redirect controller decision before following a target or exposing a redirect result.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, host, allowed, subdomains, source_host, blocked):
    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed), host.lower().rstrip('.') not in blocked, bool(allowed), len(host.rstrip('.').split('.')), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], blocked, max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})
check('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})
check('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})
check('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})
check('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}Passed
fixture 3{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': ['other.test', False, False, True, False, 2, True, ['test'], ['unrelated.test'], None], 'request': '/requests/1/5'}{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}Failed
fixture 7{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}Passed

SHA-256 / 2c7d613ad18987e30d8573d13b33bfddc7b6622dd4eb439e98e8a600619a3603

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, host, allowed, subdomains, source_host, blocked):
    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed), host.lower().rstrip('.') not in blocked, bool(allowed), len(host.rstrip('.').split('.')), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})
check('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})
check('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})
check('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})
check('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}Passed
fixture 3{'decision': ['example.test', True, True, False, True, 2, True, ['test'], [], 'example.test'], 'request': '/requests/1/2'}{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}Failed
fixture 4{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}Passed
fixture 7{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}Passed

SHA-256 / 50d623ed67ef9ea7bb0e062ab09f24f23b786a535bda89e3d5d9fec8e81f0169

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, host, allowed, subdomains, source_host, blocked):
    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed), host.lower().rstrip('.') not in blocked, bool(allowed), len(host.rstrip('.').split('.')), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [x for x in blocked if x == host.lower().rstrip('.') ], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} 
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})
check('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})
check('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})
check('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})
check('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})
check('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})
check('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}{'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/0'}Passed
fixture 2{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}{'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None], 'request': '/requests/1/1'}Passed
fixture 3{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}{'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test'], 'request': '/requests/1/2'}Passed
fixture 4{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}{'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test'], 'request': '/requests/1/3'}Passed
fixture 5{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}{'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test'], 'request': '/requests/1/4'}Passed
fixture 6{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}{'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None], 'request': '/requests/1/5'}Passed
fixture 7{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}{'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test'], 'request': '/requests/1/6'}Passed

SHA-256 / 22d2b1004460ff2e2da1080290f1376d7556f07fc05c0702d9057aa40bbdea41

Verification & scope

Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:41:35.171156+00:00.

Case digest / 3d2107492e824fe929d947944ebce47ce491f856dc2ad919d7954fc3bf0e94f6