FA-29056 / HTTP redirects / Open access
Build public redirect origins from explicitly trusted proxy metadata: empty forwarded value fallback · case 01
Build public redirect origins from explicitly trusted proxy metadata: the empty forwarded value fallback branch emits an incorrect decision.
ROOT CAUSE
The empty-forwarded-value-fallback decision uses 'trusted'; this violates the stipulated controller policy.
VERIFIED REPAIR
At this decision use 'bool(chain)', preserving the other controller outputs.
Unsuccessful approach: The partial repair uses 'bool(proto)' and still fails an explicit boundary or control.
Case contract
Build public redirect origins from explicitly trusted proxy metadata. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.
Why this case matters
Models a redirect controller decision before following a target or exposing a redirect result.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, trusted, chain, proto, direct_host, direct_scheme, prefix):
return {'request': request, 'decision': [chain[0] if trusted and chain else direct_host, proto.lower() if trusted and proto else direct_scheme, chain, trusted, '/' + prefix.lstrip('/') if prefix else '', prefix if trusted else '', direct_host, prefix.rstrip('/')+'/' if prefix else '/', not proto or proto.lower() in ('http','https'), 'forwarded' if trusted and chain else 'direct']}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', True, ['client.test', 'edge.test'], 'https', 'internal:8080', 'http', '/app'), {'request': '/requests/' + str(N) + '/0', 'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded']})
check('fixture 2', solve('/requests/' + str(N) + '/1', False, ['attacker.test'], 'https', 'public.test', 'http', '/'), {'request': '/requests/' + str(N) + '/1', 'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct']})
check('fixture 3', solve('/requests/' + str(N) + '/2', True, [], '', 'fallback.test', 'https', ''), {'request': '/requests/' + str(N) + '/2', 'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct']})
check('fixture 4', solve('/requests/' + str(N) + '/3', True, ['one.test', 'two.test', 'three.test'], 'http', 'internal', 'https', '/v2/'), {'request': '/requests/' + str(N) + '/3', 'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded']})
check('fixture 5', solve('/requests/' + str(N) + '/4', True, ['public.test'], 'HTTPS', 'internal', 'http', '//evil.test'), {'request': '/requests/' + str(N) + '/4', 'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded']})
check('fixture 6', solve('/requests/' + str(N) + '/5', False, [], 'http', 'actual.test', 'https', '/x'), {'request': '/requests/' + str(N) + '/5', 'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': ['public.test', 'http', ['attacker.test'], False, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | Failed |
| fixture 3 | {'decision': ['fallback.test', 'https', [], True, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | Failed |
| fixture 4 | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | Passed |
SHA-256 / 222b5e7bd7190964703a6c2d65693c7154ff8d844993f22e478480853ea44658
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, trusted, chain, proto, direct_host, direct_scheme, prefix):
return {'request': request, 'decision': [chain[0] if trusted and chain else direct_host, proto.lower() if trusted and proto else direct_scheme, chain, bool(proto), '/' + prefix.lstrip('/') if prefix else '', prefix if trusted else '', direct_host, prefix.rstrip('/')+'/' if prefix else '/', not proto or proto.lower() in ('http','https'), 'forwarded' if trusted and chain else 'direct']}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', True, ['client.test', 'edge.test'], 'https', 'internal:8080', 'http', '/app'), {'request': '/requests/' + str(N) + '/0', 'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded']})
check('fixture 2', solve('/requests/' + str(N) + '/1', False, ['attacker.test'], 'https', 'public.test', 'http', '/'), {'request': '/requests/' + str(N) + '/1', 'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct']})
check('fixture 3', solve('/requests/' + str(N) + '/2', True, [], '', 'fallback.test', 'https', ''), {'request': '/requests/' + str(N) + '/2', 'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct']})
check('fixture 4', solve('/requests/' + str(N) + '/3', True, ['one.test', 'two.test', 'three.test'], 'http', 'internal', 'https', '/v2/'), {'request': '/requests/' + str(N) + '/3', 'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded']})
check('fixture 5', solve('/requests/' + str(N) + '/4', True, ['public.test'], 'HTTPS', 'internal', 'http', '//evil.test'), {'request': '/requests/' + str(N) + '/4', 'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded']})
check('fixture 6', solve('/requests/' + str(N) + '/5', False, [], 'http', 'actual.test', 'https', '/x'), {'request': '/requests/' + str(N) + '/5', 'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': ['actual.test', 'https', [], True, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | Failed |
SHA-256 / 37f74063d589352f8d9780d25d8b4e642d4c8d1ffd904435fa9f701fc0458ad6
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, trusted, chain, proto, direct_host, direct_scheme, prefix):
return {'request': request, 'decision': [chain[0] if trusted and chain else direct_host, proto.lower() if trusted and proto else direct_scheme, chain, bool(chain), '/' + prefix.lstrip('/') if prefix else '', prefix if trusted else '', direct_host, prefix.rstrip('/')+'/' if prefix else '/', not proto or proto.lower() in ('http','https'), 'forwarded' if trusted and chain else 'direct']}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', True, ['client.test', 'edge.test'], 'https', 'internal:8080', 'http', '/app'), {'request': '/requests/' + str(N) + '/0', 'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded']})
check('fixture 2', solve('/requests/' + str(N) + '/1', False, ['attacker.test'], 'https', 'public.test', 'http', '/'), {'request': '/requests/' + str(N) + '/1', 'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct']})
check('fixture 3', solve('/requests/' + str(N) + '/2', True, [], '', 'fallback.test', 'https', ''), {'request': '/requests/' + str(N) + '/2', 'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct']})
check('fixture 4', solve('/requests/' + str(N) + '/3', True, ['one.test', 'two.test', 'three.test'], 'http', 'internal', 'https', '/v2/'), {'request': '/requests/' + str(N) + '/3', 'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded']})
check('fixture 5', solve('/requests/' + str(N) + '/4', True, ['public.test'], 'HTTPS', 'internal', 'http', '//evil.test'), {'request': '/requests/' + str(N) + '/4', 'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded']})
check('fixture 6', solve('/requests/' + str(N) + '/5', False, [], 'http', 'actual.test', 'https', '/x'), {'request': '/requests/' + str(N) + '/5', 'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct']})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | {'decision': ['client.test', 'https', ['client.test', 'edge.test'], True, '/app', '/app', 'internal:8080', '/app/', True, 'forwarded'], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | {'decision': ['public.test', 'http', ['attacker.test'], True, '/', '', 'public.test', '/', True, 'direct'], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | {'decision': ['fallback.test', 'https', [], False, '', '', 'fallback.test', '/', True, 'direct'], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | {'decision': ['one.test', 'http', ['one.test', 'two.test', 'three.test'], True, '/v2/', '/v2/', 'internal', '/v2/', True, 'forwarded'], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | {'decision': ['public.test', 'https', ['public.test'], True, '/evil.test', '//evil.test', 'internal', '//evil.test/', True, 'forwarded'], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | {'decision': ['actual.test', 'https', [], False, '/x', '', 'actual.test', '/x/', True, 'direct'], 'request': '/requests/1/5'} | Passed |
SHA-256 / 1cf0d52a188497680b662446e9e728ece3ead2736ca856b111c53d634a32c1b7
Verification & scope
Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:41:39.558395+00:00.
Case digest / 4e16f097cd2fef29290dc5cb9c874640b64a2b40f7b5dd8db70d204b0b4f1c86