FA-29046 / HTTP redirects / Open access
Build public redirect origins from explicitly trusted proxy metadata: trusted proto fallback · case 01
Build public redirect origins from explicitly trusted proxy metadata: the trusted proto fallback branch emits an incorrect decision.
ROOT CAUSE
The trusted-proto-fallback decision uses 'proto.lower() if proto else direct_scheme'; this violates the stipulated controller policy.
VERIFIED REPAIR
At this decision use 'proto.lower() if trusted and proto else direct_scheme', preserving the other controller outputs.
Unsuccessful approach: The partial repair uses 'proto if trusted else direct_scheme' and still fails an explicit boundary or control.
Case contract
Build public redirect origins from explicitly trusted proxy metadata. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.
Why this case matters
Models a redirect controller decision before following a target or exposing a redirect result.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, trusted, chain, proto, direct_host, direct_scheme, prefix):
return {'request': request, 'decision': [chain[0] if trusted and chain else direct_host, proto.lower() if proto else direct_scheme, chain, bool(chain), '/' + prefix.lstrip('/') if prefix else '', prefix if trusted else '', direct_host, prefix.rstrip('/')+'/' if prefix else '/', not proto or proto.lower() in ('http','https'), 'forwarded' if trusted and chain else 'direct']}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', True, ['client.test', 'edge.test'], 'https', 'internal:8080', 'http', '/app'), {'request': '/requests/' + str(N) + '/0', 'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded']})
check('fixture 2', solve('/requests/' + str(N) + '/1', False, ['attacker.test'], 'https', 'public.test', 'http', '/'), {'request': '/requests/' + str(N) + '/1', 'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct']})
check('fixture 3', solve('/requests/' + str(N) + '/2', True, [], '', 'fallback.test', 'https', ''), {'request': '/requests/' + str(N) + '/2', 'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct']})
check('fixture 4', solve('/requests/' + str(N) + '/3', True, ['one.test', 'two.test', 'three.test'], 'http', 'internal', 'https', '/v2/'), {'request': '/requests/' + str(N) + '/3', 'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded']})
check('fixture 5', solve('/requests/' + str(N) + '/4', True, ['public.test'], 'HTTPS', 'internal', 'http', '//evil.test'), {'request': '/requests/' + str(N) + '/4', 'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded']})
check('fixture 6', solve('/requests/' + str(N) + '/5', False, [], 'http', 'actual.test', 'https', '/x'), {'request': '/requests/' + str(N) + '/5', 'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': ['public.test', 'https', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | Failed |
| fixture 3 | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': ['actual.test', 'http', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | Failed |
SHA-256 / 2dab68542fe9b917fbd1d6129c3a3d0ee72f85aeac2f4ba89087c1d0d2fb0006
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, trusted, chain, proto, direct_host, direct_scheme, prefix):
return {'request': request, 'decision': [chain[0] if trusted and chain else direct_host, proto if trusted else direct_scheme, chain, bool(chain), '/' + prefix.lstrip('/') if prefix else '', prefix if trusted else '', direct_host, prefix.rstrip('/')+'/' if prefix else '/', not proto or proto.lower() in ('http','https'), 'forwarded' if trusted and chain else 'direct']}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', True, ['client.test', 'edge.test'], 'https', 'internal:8080', 'http', '/app'), {'request': '/requests/' + str(N) + '/0', 'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded']})
check('fixture 2', solve('/requests/' + str(N) + '/1', False, ['attacker.test'], 'https', 'public.test', 'http', '/'), {'request': '/requests/' + str(N) + '/1', 'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct']})
check('fixture 3', solve('/requests/' + str(N) + '/2', True, [], '', 'fallback.test', 'https', ''), {'request': '/requests/' + str(N) + '/2', 'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct']})
check('fixture 4', solve('/requests/' + str(N) + '/3', True, ['one.test', 'two.test', 'three.test'], 'http', 'internal', 'https', '/v2/'), {'request': '/requests/' + str(N) + '/3', 'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded']})
check('fixture 5', solve('/requests/' + str(N) + '/4', True, ['public.test'], 'HTTPS', 'internal', 'http', '//evil.test'), {'request': '/requests/' + str(N) + '/4', 'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded']})
check('fixture 6', solve('/requests/' + str(N) + '/5', False, [], 'http', 'actual.test', 'https', '/x'), {'request': '/requests/' + str(N) + '/5', 'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': ['fallback.test', '', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | Failed |
| fixture 4 | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': ['public.test', 'HTTPS', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | Failed |
| fixture 6 | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | Passed |
SHA-256 / 98fe5a40781e859e8948d1e223e85cce68344aa3fa76100f9ec16a0ed51cb437
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, trusted, chain, proto, direct_host, direct_scheme, prefix):
return {'request': request, 'decision': [chain[0] if trusted and chain else direct_host, proto.lower() if trusted and proto else direct_scheme, chain, bool(chain), '/' + prefix.lstrip('/') if prefix else '', prefix if trusted else '', direct_host, prefix.rstrip('/')+'/' if prefix else '/', not proto or proto.lower() in ('http','https'), 'forwarded' if trusted and chain else 'direct']}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', True, ['client.test', 'edge.test'], 'https', 'internal:8080', 'http', '/app'), {'request': '/requests/' + str(N) + '/0', 'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded']})
check('fixture 2', solve('/requests/' + str(N) + '/1', False, ['attacker.test'], 'https', 'public.test', 'http', '/'), {'request': '/requests/' + str(N) + '/1', 'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct']})
check('fixture 3', solve('/requests/' + str(N) + '/2', True, [], '', 'fallback.test', 'https', ''), {'request': '/requests/' + str(N) + '/2', 'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct']})
check('fixture 4', solve('/requests/' + str(N) + '/3', True, ['one.test', 'two.test', 'three.test'], 'http', 'internal', 'https', '/v2/'), {'request': '/requests/' + str(N) + '/3', 'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded']})
check('fixture 5', solve('/requests/' + str(N) + '/4', True, ['public.test'], 'HTTPS', 'internal', 'http', '//evil.test'), {'request': '/requests/' + str(N) + '/4', 'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded']})
check('fixture 6', solve('/requests/' + str(N) + '/5', False, [], 'http', 'actual.test', 'https', '/x'), {'request': '/requests/' + str(N) + '/5', 'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | Passed |
SHA-256 / 1cf0d52a188497680b662446e9e728ece3ead2736ca856b111c53d634a32c1b7
Verification & scope
Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:41:39.513669+00:00.
Case digest / 4ef4ddc6acd1e438750ae9e824f5da75c2021ccfed7e2e8a65129925c0f847c9