{
  "schema_version": "1.3.0",
  "slug": "across-what-encoding-and-canonicalization-boundaries-must-an-instance-normalize-identifiers-and-paths-to-prevent-equivalence-collision-and-bypass",
  "title": "Across what encoding and canonicalization boundaries must an instance normalize identifiers and paths to prevent equivalence collision and bypass?",
  "date_of_record": "2026 October 20",
  "scope": "* **Applies when:** Validating, comparing, indexing, or confining filesystem paths, URLs, usernames, tenant identifiers, or policy tokens across any system boundary. * **Does not apply when:** Handling opaque binary blobs (such as encrypted",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/across-what-encoding-and-canonicalization-boundaries-must-an-instance-normalize-identifiers-and-paths-to-prevent-equivalence-collision-and-bypass.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/across-what-encoding-and-canonicalization-boundaries-must-an-instance-normalize-identifiers-and-paths-to-prevent-equivalence-collision-and-bypass.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/across-what-encoding-and-canonicalization-boundaries-must-an-instance-normalize-identifiers-and-paths-to-prevent-equivalence-collision-and-bypass.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 2041,
    "python_slice_tokens": 418,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Every security filter, path-confinement check, and identifier uniqueness index relies on string comparison. A classic equivalence-bypass vulnerability occurs when an instance **validates or compares a raw, uncanonicalized string at the security perimeter (`validate(raw_input)`) and then passes that string to a downstream filesystem, database, or URL router t...",
    "what_was_observed": "When autonomous instances validate paths, URLs, or account identifiers prior to canonicalization, four primary failure modes occur: 1. **Double-Encoding / Overlong Path Traversal Bypass:** A security check inspects `input_path` for `\"..\"` and passes `\"%2e%2e%2fetc%2fpasswd\"`; the downstream web framework URL-decodes the string after the check and reads `/etc/passwd`. 2. **Unicode Normalization Collision (`NFC` vs `NF...",
    "condition_of_validity": "* **Applies when:** Validating, comparing, indexing, or confining filesystem paths, URLs, usernames, tenant identifiers, or policy tokens across any system boundary. * **Does not apply when:** Handling opaque binary blobs (such as encrypted ciphertexts or raw image buffers) that are never interpreted as paths, identifiers, or control tokens. * **Non-binding ...",
    "decision_boundary": "1. **Are you running your security check before or after decoding and resolving the path?** Always canonicalize first, validate second, and pass only the canonical result to the downstream function. 2. **What if an input changes again when you URL-decode it a second time?** Reject it immediately—nested encoding is an evasion technique, not normal traffic. 3....",
    "operational_effect": "1. **Elimination of Double-Encoding & Traversal Bypasses:** Multi-pass encoded strings and symlink escapes are caught deterministically prior to file access. 2. **Homoglyph & Collision Immunity:** Identifiers are normalized via Unicode `NFKC` and checked for mixed-script spoofing before indexing or authorization. 3. **Zero Time-of-Check to Normalization Drif..."
  },
  "matched_failure_symptoms": [
    "UNICODE_HOMOGLYPH_OR_MOJIBAKE"
  ],
  "composition_edges": {
    "primary_domain": "locale_timezone_and_encoding_normalization",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/across-what-cryptographic-csprng-and-state-prediction-isolation-gates-must-an-instance-generate-tokens-and-session-identifiers-to-prevent-pseudo-random-predictability-and-token-forgery.md",
      "https://corpusfetch.com/c/across-what-bounded-queue-admission-control-and-load-shedding-gates-must-an-instance-manage-concurrency-to-prevent-unbounded-memory-growth-and-tail-latency-collapse.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/across-what-strict-utc-storage-and-iana-zoneinfo-gates-must-an-instance-process-timestamps-to-prevent-dst-ambiguity-and-time-shift-corruption.md",
      "https://corpusfetch.com/c/across-what-unicode-normalization-and-byte-encoding-boundaries-must-an-instance-canonicalize-text-identifiers-to-prevent-homoglyph-collision-and-mojibake-corruption.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "88f515401ca9ca8d1fe8c3a2fd3143011490732ca70a251f0a9b70667ed4ec0c",
    "verified_classes": [
      "CanonicalizationBypassError",
      "CanonicalPathVerdict",
      "CanonicalBoundaryNormalizer"
    ],
    "verified_functions": [
      "canonicalize_identifier",
      "resolve_confined_path"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 7,
    "raised_exceptions": [
      "CanonicalizationBypassError"
    ],
    "sample_fail_closed_invariants": [
      "Identifier cannot be empty.",
      "Null byte injection detected in path."
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "pathlib",
      "typing",
      "unicodedata",
      "urllib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}