c0fb53548c
The userinfo check read the authority after `//`, so `https:\\alice:pw@host`, `https:alice:pw@host` and `https:/\alice:pw@host` passed. object.url now refuses any `?`, `#`, `@` or `\`, a path `@` included, so no query, fragment or user information enters an observation however a parser splits the URL. Corpus cases for the three bypasses, a backslash alone and a path `@`; the escaped-URL observation keeps a quote (its backslash moved out with the rule). Section 8.2 also states that no syntax keeps an address, a token or personal data out of `cid`: an emitter MUST NOT put one there, and the charset stays a syntax rule. Co-Authored-By: Claude Opus 5.5 <[email protected]>
123 lines
8.7 KiB
JSON
123 lines
8.7 KiB
JSON
{
|
|
"01-request-base": {
|
|
"mode": "request",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",d=40,dl=200,ot=v,science.transaction.wai-b=\"460\",science.transaction.wai-cap=\"wai.neural.int_hyper\",science.transaction.wai-ch=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",science.transaction.wai-coh=\"wai\",science.transaction.wai-l=\"0\",science.transaction.wai-lt=\"4\",science.transaction.wai-p=\"p\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=0,st=v,v=2",
|
|
"headers": {
|
|
"CMCD-Object": "d=40,ot=v,science.transaction.wai-b=\"460\",science.transaction.wai-cap=\"wai.neural.int_hyper\",science.transaction.wai-ch=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",science.transaction.wai-l=\"0\",science.transaction.wai-lt=\"4\",science.transaction.wai-p=\"p\"",
|
|
"CMCD-Request": "dl=200,sn=0",
|
|
"CMCD-Session": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",science.transaction.wai-coh=\"wai\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",st=v,v=2"
|
|
}
|
|
},
|
|
"02-request-layer": {
|
|
"mode": "request",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",dl=400,ot=v,science.transaction.wai-b=\"951\",science.transaction.wai-cap=\"wai.image.int_refine\",science.transaction.wai-ch=\"4fc1bd94bd48b2c1ded99c0053eed742f5399cec09dbd2f8694cca6a30e44875\",science.transaction.wai-l=\"1\",science.transaction.wai-lc=\"2\",science.transaction.wai-lt=\"4\",science.transaction.wai-p=\"p\",science.transaction.wai-rcpt=\"7bf0f413db62aa185969b9ccf925d40f0281601268899bb7f2e97344487f4189\",science.transaction.wai-tx=\"951\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=1,st=v,v=2",
|
|
"headers": {
|
|
"CMCD-Object": "ot=v,science.transaction.wai-b=\"951\",science.transaction.wai-cap=\"wai.image.int_refine\",science.transaction.wai-ch=\"4fc1bd94bd48b2c1ded99c0053eed742f5399cec09dbd2f8694cca6a30e44875\",science.transaction.wai-l=\"1\",science.transaction.wai-lt=\"4\",science.transaction.wai-p=\"p\",science.transaction.wai-rcpt=\"7bf0f413db62aa185969b9ccf925d40f0281601268899bb7f2e97344487f4189\",science.transaction.wai-tx=\"951\"",
|
|
"CMCD-Request": "dl=400,science.transaction.wai-lc=\"2\",sn=1",
|
|
"CMCD-Session": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",st=v,v=2"
|
|
}
|
|
},
|
|
"03-request-rendition": {
|
|
"mode": "request",
|
|
"report": "ot=o,science.transaction.wai-b=\"2519\",science.transaction.wai-p=\"f\",science.transaction.wai-ri=\"1\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=2,st=v,v=2",
|
|
"headers": {
|
|
"CMCD-Object": "ot=o,science.transaction.wai-b=\"2519\",science.transaction.wai-p=\"f\",science.transaction.wai-ri=\"1\"",
|
|
"CMCD-Request": "sn=2",
|
|
"CMCD-Session": "sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",st=v,v=2"
|
|
}
|
|
},
|
|
"04-response": {
|
|
"mode": "event",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=rr,rc=200,science.transaction.wai-b=\"460\",science.transaction.wai-ch=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",science.transaction.wai-p=\"p\",science.transaction.wai-tx=\"460\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=3,st=v,ts=1790000000120,ttfb=38,ttlb=41,url=\"https://media.example/t/base.wai\",v=2",
|
|
"headers": null
|
|
},
|
|
"05-start": {
|
|
"mode": "event",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ps,sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=4,st=v,sta=s,ts=1790000000000,v=2",
|
|
"headers": null
|
|
},
|
|
"06-present-first": {
|
|
"mode": "event",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ps,msd=160,science.transaction.wai-dec=\"2900\",science.transaction.wai-pl=\"1\",science.transaction.wai-u=\"0\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=5,st=v,sta=p,ts=1790000000160,v=2",
|
|
"headers": null
|
|
},
|
|
"07-present-later": {
|
|
"mode": "none",
|
|
"report": null,
|
|
"headers": null
|
|
},
|
|
"08-stall-start": {
|
|
"mode": "event",
|
|
"report": "bsa=(1),bsda=(0),cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ps,sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=7,st=v,sta=r,ts=1790000004000,v=2",
|
|
"headers": null
|
|
},
|
|
"09-stall-end": {
|
|
"mode": "event",
|
|
"report": "bsa=(1),bsda=(350),cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ps,sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=8,st=v,sta=p,ts=1790000004350,v=2",
|
|
"headers": null
|
|
},
|
|
"10-switch": {
|
|
"mode": "event",
|
|
"report": "cen=\"wai-switch\",cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ce,science.transaction.wai-p=\"f\",science.transaction.wai-sw=\"prior-not-held\",science.transaction.wai-u=\"125\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=9,st=v,ts=1790000005000,v=2",
|
|
"headers": null
|
|
},
|
|
"11-layer-change": {
|
|
"mode": "event",
|
|
"report": "cen=\"wai-layer-change\",cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ce,science.transaction.wai-lc=\"1\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=10,st=v,ts=1790000006000,v=2",
|
|
"headers": null
|
|
},
|
|
"12-frame-drop": {
|
|
"mode": "event",
|
|
"report": "cen=\"wai-frame-drop\",cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",dfa=3,e=ce,sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=11,st=v,ts=1790000006500,v=2",
|
|
"headers": null
|
|
},
|
|
"13-capable-pin-refused": {
|
|
"mode": "event",
|
|
"report": "cen=\"wai-capable\",cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ce,science.transaction.wai-cf=\"supported\",science.transaction.wai-co=\"pin-refused\",science.transaction.wai-cr=\"part-mismatch\",sf=o,sid=\"0d9c8b7a6f5e4d3c2b1a09f8e7d6c5b4\",sn=0,st=v,ts=1790000000010,v=2",
|
|
"headers": null
|
|
},
|
|
"14-capable": {
|
|
"mode": "event",
|
|
"report": "cen=\"wai-capable\",cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ce,science.transaction.wai-co=\"capable\",science.transaction.wai-coh=\"control\",sf=o,sid=\"0d9c8b7a6f5e4d3c2b1a09f8e7d6c5b4\",sn=1,st=v,ts=1790000000011,v=2",
|
|
"headers": null
|
|
},
|
|
"15-abandon": {
|
|
"mode": "event",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ps,sf=o,sid=\"0d9c8b7a6f5e4d3c2b1a09f8e7d6c5b4\",sn=2,st=v,sta=q,ts=1790000000900,v=2",
|
|
"headers": null
|
|
},
|
|
"16-end": {
|
|
"mode": "event",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ps,science.transaction.wai-clm=\"e6e42e268f003a39dd887e6bdaf1501a270bcc63c29d5c40bbeedcb0b29d4277\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=12,st=v,sta=e,ts=1790000009000,v=2",
|
|
"headers": null
|
|
},
|
|
"17-live-low-latency": {
|
|
"mode": "event",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ps,sf=h,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=13,st=ll,sta=s,ts=1790000009100,v=2",
|
|
"headers": null
|
|
},
|
|
"18-switch-prior-revoked": {
|
|
"mode": "event",
|
|
"report": "cen=\"wai-switch\",cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ce,science.transaction.wai-p=\"f\",science.transaction.wai-sw=\"prior-revoked\",science.transaction.wai-u=\"126\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=14,st=v,ts=1790000009200,v=2",
|
|
"headers": null
|
|
},
|
|
"19-capable-not-authorised": {
|
|
"mode": "event",
|
|
"report": "cen=\"wai-capable\",cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=ce,science.transaction.wai-co=\"pin-refused\",science.transaction.wai-cr=\"prior-not-authorised\",sf=o,sid=\"0d9c8b7a6f5e4d3c2b1a09f8e7d6c5b4\",sn=3,st=v,ts=1790000000012,v=2",
|
|
"headers": null
|
|
},
|
|
"20-request-escaped": {
|
|
"mode": "request",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",ot=v,science.transaction.wai-b=\"12\",science.transaction.wai-cap=\"x.test.\\\"quoted\\\"\\\\cap\",science.transaction.wai-p=\"p\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=15,st=v,v=2",
|
|
"headers": {
|
|
"CMCD-Object": "ot=v,science.transaction.wai-b=\"12\",science.transaction.wai-cap=\"x.test.\\\"quoted\\\"\\\\cap\",science.transaction.wai-p=\"p\"",
|
|
"CMCD-Request": "sn=15",
|
|
"CMCD-Session": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",st=v,v=2"
|
|
}
|
|
},
|
|
"21-response-escaped": {
|
|
"mode": "event",
|
|
"report": "cid=\"aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f\",e=rr,rc=200,science.transaction.wai-b=\"12\",science.transaction.wai-p=\"p\",sf=o,sid=\"6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968\",sn=16,st=v,ts=1790000009300,url=\"https://media.example/t/a\\\"b.wai\",v=2",
|
|
"headers": null
|
|
}
|
|
}
|