Split Decision

A document gateway authorizes a requested name before a separate archive layer opens it. Test whether both layers interpret a repeated query key identically.

Objective

Demonstrate a first-value/last-value parser disagreement.
Explain why security layers need one canonical request interpretation.

Before you begin

Open /challenge/insane/split. Preserve any verification material returned by this stage because False Identity depends on it.

Concepts

URL query keys can repeat. If authorization selects the first occurrence while business logic selects the last, one request can represent two different objects across a trust boundary.

Two components read the same repeated synthetic field differently: one selects the first value and the other selects the last. A shared parsing rule avoids disagreement.

If two components interpret the same bytes differently, a decision made by one may not describe the value used by the other. This synthetic display-preference example shows the mismatch without a privilege-changing input. Define one schema and parsing policy; reject ambiguous duplicates or use a consistent documented representation.

Suggested tools

HTTP client: Preserve parameter order and repeated keys.
Notebook: Record the signed name, opened name, and resulting key material.

Tool practice

Rehearse the worked tool exercise before using challenge data.

An ordinary dictionary cannot retain two values under the same key. When constructing a query in Python, use an ordered list of pairs: urlencode([("display", "compact"), ("display", "roomy")]) produces display=compact&display=roomy. Inspect the final URL before sending it.

Investigation

Observe

Fetch the document listing, obtain a valid signature for the approved document, and verify its ordinary export first.

Form a hypothesis

Can a repeated key make authorization and file selection use different known documents while the signature remains valid?

Test carefully

Repeat only the documented doc key; do not alter the signature or enumerate unlisted documents.

Progressive hints

Hint 1

Sign the one document the listing marks signable.

Hint 2

Place two doc keys in one export query.

Hint 3

Use the ordinary request to infer which occurrence each layer reads.

Troubleshooting and reset

Some clients collapse duplicate keys; construct the raw query string yourself. The stage is stateless, but save its output before moving on.