{"repro_id":"REPRO-2026-00298","version":6,"title":"Horilla protected_media composed chain: unauthenticated outside-root file read, with necessity controls for each component defect","repro_type":"security","status":"published","severity":"high","description":"Horilla HR protected_media() view has two independently necessary defects that compose into an unauthenticated arbitrary file read: (1) path traversal via unsanitized os.path.join(MEDIA_ROOT, path) and (2) Referer-based authorization bypass. A single HTTP request with no cookie/session/JWT/bearer, carrying a spoofed Referer header pointing to /login, bypasses auth and escapes MEDIA_ROOT to read any file readable by the Horilla process.","root_cause":"# Root Cause Analysis: Horilla Protected Media Unauthenticated Outside-Root Read (Composed Chain)\n\n## Summary\n\nHorilla HRMS's `protected_media()` view in `base/views.py` composes two independently necessary defects: (1) a **Referer-based authorization bypass** that treats any request whose `Referer` path matches a public page (e.g., `/login`) as authenticated, and (2) an **uncontained `os.path.join()` path traversal** that allows the requested media path to escape `MEDIA_ROOT` via dot-segment traversal (`../`). A single HTTP request carrying no cookie, no session, no JWT, and no bearer token — only a crafted `Referer: http://attacker.invalid/login` header and a traversal path `/media/../canary_outside.txt` — returns the contents of a file stored outside the media directory. This reproduction establishes the composition by showing that removing either defect breaks the chain while the other remains independently exploitable.\n\n## Impact\n\n- **Package/component affected**: `base/views.py` — `protected_media()` view, routed via `base/urls.py` as `re_path(r\"^media/(?P<path>.*)$\", views.protected_media, name=\"protected_media\")`.\n- **Affected versions**: Horilla HRMS `1.5.0` (commit `61bd5173220d19925ad8220db9152a75c881ea73`). Both defects are present. The traversal fix landed in commit `67ac2056813ee95d4c4a0bfe7c0124a361cb6c48` (2026-02-23) and the authorization fix landed in commit `b6eaec1386d8b8741a42fe7c78f318f073375791` (2026-05-20), both included in tag `1.6.0` (commit `b3bd29d15819cbece45c58e6268ddd0614e387d6`).\n- **Risk level and consequences**: High. An unauthenticated remote attacker can read arbitrary files accessible to the Horilla process by combining the Referer bypass with the path traversal. Impact is bounded to file read (info_leak); no code execution, privilege escalation, or account takeover is claimed.\n\n## Impact Parity\n\n- **Disclosed/claimed maximum impact**: Unauthenticated arbitrary file read (info_leak) via the real `/media/<path>` HTTP route.\n- **Reproduced impact from this run**: Unauthenticated read of a canary file stored outside `MEDIA_ROOT` via a single HTTP request with `Referer: http://attacker.invalid/login` and path `/media/../canary_outside.txt`. Response body exactly equals the outside-root canary. No credential of any kind was sent.\n- **Parity**: `full`.\n- **Not demonstrated**: No code execution, privilege escalation, session forgery, or secret extraction. The oracle is a random canary, not a real secret.\n\n## Root Cause\n\n### Defect 1: Referer Authorization Bypass (GHSA-9wjx-4j4r-ff8w)\n\nThe `protected_media()` view on `1.5.0` checks whether the URL path extracted from the `Referer` header is in a `public_pages` list:\n\n```python\nreferer_path = urlparse(request.META.get(\"HTTP_REFERER\", \"\")).path\nif referer_path not in public_pages and not any(\n    path.startswith(f) for f in exempted_folders\n):\n    if not request.user.is_authenticated and not jwt_user:\n        # ... redirect to login\n```\n\nSince `/login` is in `public_pages`, any request with `Referer: http://attacker.invalid/login` bypasses the authentication check entirely — regardless of whether the request carries a cookie, session, or token. The attacker controls the `Referer` header, so this is a trivial authorization bypass.\n\n### Defect 2: Uncontained `os.path.join()` Path Traversal (GHSA-x52c-5hrq-76pq)\n\nThe view constructs the file path with:\n\n```python\nmedia_path = os.path.join(settings.MEDIA_ROOT, path)\n```\n\nPython's `os.path.join()` does not contain the result within `MEDIA_ROOT`. If `path` contains `..` segments (e.g., `../canary_outside.txt`), the resulting path escapes the media directory. The `os.path.exists()` check and `FileResponse(open(media_path, \"rb\"))` call then operate on a file outside `MEDIA_ROOT`.\n\n### Composition\n\nA single unauthenticated request with both `Referer: http://attacker.invalid/login` and path `/media/../canary_outside.txt`:\n1. The Referer bypass skips the authentication gate.\n2. The `os.path.join()` traversal escapes `MEDIA_ROOT`.\n3. `FileResponse` returns the outside-root file.\n\n### Fixes\n\n- **Traversal fix** (commit `67ac2056`): Replaced `os.path.join()` with Django's `safe_join()`, which raises `ValueError` if the path escapes the base directory. Also added `os.path.isfile()` check.\n- **Authorization fix** (commit `b6eaec13`, included in `1.6.0`): Removed the `Referer`-based authorization entirely. Replaced with `public_media_prefixes` that only exempt specific asset directories (e.g., `base/icon/`), requiring authentication for all other media.\n\n## Reproduction Steps\n\n1. **Script**: `bundle/repro/reproduction_steps.sh`\n2. **What the script does**:\n   - Clones (or reuses cached) the Horilla HRMS repository.\n   - For each of three upstream refs (`1.5.0`, `67ac2056`, `1.6.0`), checks out the ref, installs its `requirements.txt`, runs migrations on a fresh SQLite database, creates two random canary files (one outside `MEDIA_ROOT`, one inside at a nonpublic path), and starts the real Django `runserver`.\n   - Sends real HTTP requests via `curl --path-as-is` (preserving dot segments) from a separate attacker process to the running Horilla server.\n   - **1.5.0 (vulnerable oracle)**: Sends the escaping request without Referer (expect 302 denied), with Referer (expect 200 + outside canary), and as an authenticated low-priv user (expect 200 + outside canary). Also sends an in-root request with Referer (expect 200 + in-root canary).\n   - **67ac2056 (containment necessity control)**: Sends the escaping chain request with Referer (expect 404 — safe_join blocks traversal) and an in-root request with Referer (expect 200 + in-root canary — Referer bypass still works).\n   - **1.6.0 (fixed control)**: Sends the chain request with Referer (expect 404), in-root request with Referer (expect 302 — no bypass), and a legitimate authenticated in-root request (expect 200 — service works).\n   - Runs the complete three-ref matrix **twice** from clean targets with new canaries.\n3. **Expected evidence**: All tests pass (exit 0). Evidence files under `bundle/repro/evidence/` include request/response captures, HTTP headers, status codes, server logs with server-observed paths, and canary verification for every request.\n\n## Evidence\n\n- **Main log**: `bundle/logs/reproduction_steps.log` — complete execution output.\n- **Run logs**: `bundle/logs/reproduction_run1.log`, `bundle/logs/reproduction_run2.log` (if separate).\n- **Evidence directory**: `bundle/repro/evidence/run{1,2}/{1.5.0,67ac2056,1.6.0}/`\n  - `request_*.txt` — request metadata (method, URL, path, cookie/auth status, headers)\n  - `response_*.txt` — response body\n  - `headers_*.txt` — response headers\n  - `status_*.txt` — HTTP status code\n  - `server.log` — Django dev server log with server-observed paths\n  - `server_observed_paths.txt` — extracted server-observed paths\n  - `checkout.log` — git checkout and resolved commit\n  - `migrate.log` — migration output\n  - `modified_files.txt` — startup accommodation inventory\n  - `media_root_check.txt` — MEDIA_ROOT and outside-canary path verification\n  - `outside_canary_value.txt` / `inroot_canary_value.txt` — canary values\n  - `create_user.log` — low-priv user creation (is_staff=False, is_superuser=False)\n  - `cookies.txt` — session cookies for authenticated requests\n- **Runtime manifest**: `bundle/repro/runtime_manifest.json`\n- **Validation verdict**: `bundle/repro/validation_verdict.json`\n\n### Key evidence excerpts (from initial validation)\n\nOn `1.5.0`:\n- `GET /media/../canary_outside.txt` without Referer → HTTP 302 (redirect to login), no canary in body.\n- `GET /media/../canary_outside.txt` with `Referer: http://attacker.invalid/login` → HTTP 200, body = outside-root canary.\n- Server log: `\"GET /media/../canary_outside.txt HTTP/1.1\" 302 0` then `\"GET /media/../canary_outside.txt HTTP/1.1\" 200 21`.\n\nOn `67ac2056`:\n- `GET /media/../canary_outside.txt` with Referer → HTTP 404 (safe_join blocks traversal).\n- `GET /media/private_inroot/canary_inroot.txt` with Referer → HTTP 200, body = in-root canary.\n- Server log: `\"GET /media/../canary_outside.txt HTTP/1.1\" 404 52013` then `\"GET /media/private_inroot/canary_inroot.txt HTTP/1.1\" 200 47`.\n\nOn `1.6.0`:\n- `GET /media/../canary_outside.txt` with Referer → HTTP 404 (safe_join blocks traversal).\n- `GET /media/private_inroot/canary_inroot.txt` with Referer → HTTP 302 (no Referer bypass, redirect to login).\n- Authenticated `GET /media/private_inroot/canary_inroot.txt` → HTTP 200, body = in-root canary (service works).\n- Server log: `\"GET /media/../canary_outside.txt HTTP/1.1\" 404 52013`, `\"GET /media/private_inroot/canary_inroot.txt HTTP/1.1\" 302 0`, `\"GET /media/private_inroot/canary_inroot.txt HTTP/1.1\" 200 47`.\n\n## Recommendations / Next Steps\n\n- **Upgrade to 1.6.0 or later**: Both defects are fixed in tag `1.6.0`. The `safe_join()` containment and the removal of the Referer-based authorization together close the composed chain.\n- **Do not restore Referer-based authorization**: The Referer header is attacker-controlled and must not be used as an authorization mechanism. The `public_media_prefixes` approach in `1.6.0` is the correct pattern.\n- **Always use `safe_join()` for file path containment**: Never use `os.path.join()` to construct paths that must stay within a base directory.\n- **Testing recommendations**: Add integration tests that send requests with attacker-controlled `Referer` headers and traversal paths to `protected_media()`. Verify that unauthenticated requests with any `Referer` value are denied for non-public media.\n\n## Additional Notes\n\n- **Idempotency**: The script is idempotent — it cleans up generated files (canaries, SQLite DB) before each ref checkout and uses fresh random canaries for each run. Running it multiple times produces the same pass/fail results.\n- **Canary approach**: The oracle is a random canary file, never a real secret. No configuration files, databases, `/proc` entries, password material, credentials, or employee records are read or retained.\n- **HTTP client**: `curl --path-as-is` is used to preserve dot segments verbatim. Redirects are not followed automatically (`-L` not used), so 302 responses are recorded as-is.\n- **Modified files**: The only startup accommodations are creating canary files and a SQLite database, which are untracked data files. No source files (`base/views.py`, `base/urls.py`, routing, middleware, authentication, or file-open behavior) are modified.\n- **Dependency note**: `PyMuPDF==1.24.5` (pinned in `requirements.txt`) does not build on Python 3.14. A newer `PyMuPDF` with pre-built wheels is installed instead. This does not affect the `protected_media()` code path.\n- **Out of scope**: The `1.6.0` dot-segment prefix-normalization bypass (tracked by `HORILLA-PROTECTED-MEDIA-PREFIX-NORMALIZATION-BYPASS`) is not tested here and is not used to satisfy or fail any control.\n","source_url":"https://github.com/horilla/horilla-hr","package":{"name":"horilla/horilla-hr","ecosystem":"github"},"reproduced_at":"2026-07-27T00:57:45.360739+00:00","duration_secs":3282.0,"tool_calls":254,"handoffs":2,"total_cost_usd":3.625559,"agent_costs":{"claim_matcher":0.029526,"judge":0.044288,"learning_policy":0.021735,"repro":2.7035,"support":0.075709,"vuln_variant":0.750801},"cost_breakdown":{"claim_matcher":{"gpt-5.4-mini-2026-03-17":0.029526},"judge":{"gpt-5.4-mini":0.044288},"learning_policy":{"gpt-5.4-mini-2026-03-17":0.021735},"repro":{"accounts/fireworks/routers/glm-5p2-fast":2.7035},"support":{"accounts/fireworks/routers/glm-5p2-fast":0.075709},"vuln_variant":{"accounts/fireworks/routers/glm-5p2-fast":0.750801}},"quality":{"confidence":"high","idempotent_verified":false,"community_verifications":0},"evidence":{"workflow":{"profile":"known_vulnerability","schema_version":2,"stages":["support","claim_contract","repro","judge","vuln_variant"]}},"environment":{"sandbox_image":"ghcr.io/n3mes1s/pruva-sandbox@sha256:8096b2518d6022e13d68f885c3b8ded6b4fe607098b1a1ccbfb99abc004d1dc1"},"published_at":"2026-07-27T00:57:46.879456+00:00","retracted":false,"artifacts":[{"path":"bundle/repro/reproduction_steps.sh","filename":"reproduction_steps.sh","size":21063,"category":"reproduction_script"},{"path":"bundle/repro/rca_report.md","filename":"rca_report.md","size":10925,"category":"analysis"},{"path":"bundle/repro/runtime_manifest.json","filename":"runtime_manifest.json","size":8746,"category":"other"},{"path":"bundle/logs/reproduction_steps.log","filename":"reproduction_steps.log","size":5413,"category":"log"},{"path":"bundle/repro/evidence/run2/1.6.0/checkout.log","filename":"checkout.log","size":356,"category":"log"},{"path":"bundle/repro/evidence/run2/1.6.0/cookies.txt","filename":"cookies.txt","size":458,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/create_user.log","filename":"create_user.log","size":85,"category":"log"},{"path":"bundle/repro/evidence/run2/1.6.0/headers_auth_inroot.txt","filename":"headers_auth_inroot.txt","size":539,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/headers_chain_referer.txt","filename":"headers_chain_referer.txt","size":504,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/headers_inroot_referer.txt","filename":"headers_inroot_referer.txt","size":747,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/inroot_canary_value.txt","filename":"inroot_canary_value.txt","size":46,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/login_response.txt","filename":"login_response.txt","size":0,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/login_status.txt","filename":"login_status.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/makemigrations.log","filename":"makemigrations.log","size":20,"category":"log"},{"path":"bundle/repro/evidence/run2/1.6.0/media_root_check.txt","filename":"media_root_check.txt","size":133,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/migrate.log","filename":"migrate.log","size":3931,"category":"log"},{"path":"bundle/repro/evidence/run2/1.6.0/modified_files.txt","filename":"modified_files.txt","size":22,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/outside_canary_value.txt","filename":"outside_canary_value.txt","size":52,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/pip_install.log","filename":"pip_install.log","size":278,"category":"log"},{"path":"bundle/repro/evidence/run2/1.6.0/request_auth_inroot.txt","filename":"request_auth_inroot.txt","size":202,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/request_chain_referer.txt","filename":"request_chain_referer.txt","size":229,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/request_inroot_referer.txt","filename":"request_inroot_referer.txt","size":247,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/response_auth_inroot.txt","filename":"response_auth_inroot.txt","size":47,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/response_chain_referer.txt","filename":"response_chain_referer.txt","size":52013,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/response_inroot_referer.txt","filename":"response_inroot_referer.txt","size":0,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/server.log","filename":"server.log","size":449,"category":"log"},{"path":"bundle/repro/evidence/run2/1.6.0/server_observed_paths.txt","filename":"server_observed_paths.txt","size":125,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/status_auth_inroot.txt","filename":"status_auth_inroot.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/status_chain_referer.txt","filename":"status_chain_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/1.6.0/status_inroot_referer.txt","filename":"status_inroot_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/checkout.log","filename":"checkout.log","size":356,"category":"log"},{"path":"bundle/repro/evidence/run2/67ac2056/headers_chain_referer.txt","filename":"headers_chain_referer.txt","size":504,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/headers_inroot_referer.txt","filename":"headers_inroot_referer.txt","size":539,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/inroot_canary_value.txt","filename":"inroot_canary_value.txt","size":46,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/makemigrations.log","filename":"makemigrations.log","size":20,"category":"log"},{"path":"bundle/repro/evidence/run2/67ac2056/media_root_check.txt","filename":"media_root_check.txt","size":133,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/migrate.log","filename":"migrate.log","size":3931,"category":"log"},{"path":"bundle/repro/evidence/run2/67ac2056/modified_files.txt","filename":"modified_files.txt","size":22,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/outside_canary_value.txt","filename":"outside_canary_value.txt","size":52,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/pip_install.log","filename":"pip_install.log","size":949,"category":"log"},{"path":"bundle/repro/evidence/run2/67ac2056/request_chain_referer.txt","filename":"request_chain_referer.txt","size":229,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/request_inroot_referer.txt","filename":"request_inroot_referer.txt","size":248,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/response_chain_referer.txt","filename":"response_chain_referer.txt","size":52013,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/response_inroot_referer.txt","filename":"response_inroot_referer.txt","size":47,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/server.log","filename":"server.log","size":257,"category":"log"},{"path":"bundle/repro/evidence/run2/67ac2056/server_observed_paths.txt","filename":"server_observed_paths.txt","size":77,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/status_chain_referer.txt","filename":"status_chain_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/67ac2056/status_inroot_referer.txt","filename":"status_inroot_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/checkout.log","filename":"checkout.log","size":182,"category":"log"},{"path":"bundle/repro/evidence/run2/1.5.0/cookies.txt","filename":"cookies.txt","size":458,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/create_user.log","filename":"create_user.log","size":85,"category":"log"},{"path":"bundle/repro/evidence/run2/1.5.0/headers_auth_escape.txt","filename":"headers_auth_escape.txt","size":540,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/headers_chain_no_referer.txt","filename":"headers_chain_no_referer.txt","size":747,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/headers_chain_with_referer.txt","filename":"headers_chain_with_referer.txt","size":540,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/headers_inroot_referer.txt","filename":"headers_inroot_referer.txt","size":539,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/inroot_canary_value.txt","filename":"inroot_canary_value.txt","size":46,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/login_response.txt","filename":"login_response.txt","size":0,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/login_status.txt","filename":"login_status.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/makemigrations.log","filename":"makemigrations.log","size":20,"category":"log"},{"path":"bundle/repro/evidence/run2/1.5.0/media_root_check.txt","filename":"media_root_check.txt","size":133,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/migrate.log","filename":"migrate.log","size":3931,"category":"log"},{"path":"bundle/repro/evidence/run2/1.5.0/modified_files.txt","filename":"modified_files.txt","size":22,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/outside_canary_value.txt","filename":"outside_canary_value.txt","size":52,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/pip_install.log","filename":"pip_install.log","size":278,"category":"log"},{"path":"bundle/repro/evidence/run2/1.5.0/request_auth_escape.txt","filename":"request_auth_escape.txt","size":180,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/request_chain_no_referer.txt","filename":"request_chain_no_referer.txt","size":169,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/request_chain_with_referer.txt","filename":"request_chain_with_referer.txt","size":226,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/request_inroot_referer.txt","filename":"request_inroot_referer.txt","size":248,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/response_auth_escape.txt","filename":"response_auth_escape.txt","size":53,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/response_chain_no_referer.txt","filename":"response_chain_no_referer.txt","size":0,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/response_chain_with_referer.txt","filename":"response_chain_with_referer.txt","size":53,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/response_inroot_referer.txt","filename":"response_inroot_referer.txt","size":47,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/server.log","filename":"server.log","size":469,"category":"log"},{"path":"bundle/repro/evidence/run2/1.5.0/server_observed_paths.txt","filename":"server_observed_paths.txt","size":143,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/status_auth_escape.txt","filename":"status_auth_escape.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/status_chain_no_referer.txt","filename":"status_chain_no_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/status_chain_with_referer.txt","filename":"status_chain_with_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run2/1.5.0/status_inroot_referer.txt","filename":"status_inroot_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/checkout.log","filename":"checkout.log","size":356,"category":"log"},{"path":"bundle/repro/evidence/run1/1.6.0/cookies.txt","filename":"cookies.txt","size":458,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/create_user.log","filename":"create_user.log","size":85,"category":"log"},{"path":"bundle/repro/evidence/run1/1.6.0/headers_auth_inroot.txt","filename":"headers_auth_inroot.txt","size":539,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/headers_chain_referer.txt","filename":"headers_chain_referer.txt","size":504,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/headers_inroot_referer.txt","filename":"headers_inroot_referer.txt","size":747,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/inroot_canary_value.txt","filename":"inroot_canary_value.txt","size":46,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/login_response.txt","filename":"login_response.txt","size":0,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/login_status.txt","filename":"login_status.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/makemigrations.log","filename":"makemigrations.log","size":20,"category":"log"},{"path":"bundle/repro/evidence/run1/1.6.0/media_root_check.txt","filename":"media_root_check.txt","size":133,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/migrate.log","filename":"migrate.log","size":3931,"category":"log"},{"path":"bundle/repro/evidence/run1/1.6.0/modified_files.txt","filename":"modified_files.txt","size":22,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/outside_canary_value.txt","filename":"outside_canary_value.txt","size":52,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/pip_install.log","filename":"pip_install.log","size":278,"category":"log"},{"path":"bundle/repro/evidence/run1/1.6.0/request_auth_inroot.txt","filename":"request_auth_inroot.txt","size":202,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/request_chain_referer.txt","filename":"request_chain_referer.txt","size":229,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/request_inroot_referer.txt","filename":"request_inroot_referer.txt","size":247,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/response_auth_inroot.txt","filename":"response_auth_inroot.txt","size":47,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/response_chain_referer.txt","filename":"response_chain_referer.txt","size":52013,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/response_inroot_referer.txt","filename":"response_inroot_referer.txt","size":0,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/server.log","filename":"server.log","size":449,"category":"log"},{"path":"bundle/repro/evidence/run1/1.6.0/server_observed_paths.txt","filename":"server_observed_paths.txt","size":125,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/status_auth_inroot.txt","filename":"status_auth_inroot.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/status_chain_referer.txt","filename":"status_chain_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/1.6.0/status_inroot_referer.txt","filename":"status_inroot_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/checkout.log","filename":"checkout.log","size":356,"category":"log"},{"path":"bundle/repro/evidence/run1/67ac2056/headers_chain_referer.txt","filename":"headers_chain_referer.txt","size":504,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/headers_inroot_referer.txt","filename":"headers_inroot_referer.txt","size":539,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/inroot_canary_value.txt","filename":"inroot_canary_value.txt","size":46,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/makemigrations.log","filename":"makemigrations.log","size":20,"category":"log"},{"path":"bundle/repro/evidence/run1/67ac2056/media_root_check.txt","filename":"media_root_check.txt","size":133,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/migrate.log","filename":"migrate.log","size":3931,"category":"log"},{"path":"bundle/repro/evidence/run1/67ac2056/modified_files.txt","filename":"modified_files.txt","size":22,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/outside_canary_value.txt","filename":"outside_canary_value.txt","size":52,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/pip_install.log","filename":"pip_install.log","size":949,"category":"log"},{"path":"bundle/repro/evidence/run1/67ac2056/request_chain_referer.txt","filename":"request_chain_referer.txt","size":229,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/request_inroot_referer.txt","filename":"request_inroot_referer.txt","size":248,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/response_chain_referer.txt","filename":"response_chain_referer.txt","size":52013,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/response_inroot_referer.txt","filename":"response_inroot_referer.txt","size":47,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/server.log","filename":"server.log","size":257,"category":"log"},{"path":"bundle/repro/evidence/run1/67ac2056/server_observed_paths.txt","filename":"server_observed_paths.txt","size":77,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/status_chain_referer.txt","filename":"status_chain_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/67ac2056/status_inroot_referer.txt","filename":"status_inroot_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/checkout.log","filename":"checkout.log","size":182,"category":"log"},{"path":"bundle/repro/evidence/run1/1.5.0/cookies.txt","filename":"cookies.txt","size":458,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/create_user.log","filename":"create_user.log","size":85,"category":"log"},{"path":"bundle/repro/evidence/run1/1.5.0/headers_auth_escape.txt","filename":"headers_auth_escape.txt","size":540,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/headers_chain_no_referer.txt","filename":"headers_chain_no_referer.txt","size":747,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/headers_chain_with_referer.txt","filename":"headers_chain_with_referer.txt","size":540,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/headers_inroot_referer.txt","filename":"headers_inroot_referer.txt","size":539,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/inroot_canary_value.txt","filename":"inroot_canary_value.txt","size":46,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/login_response.txt","filename":"login_response.txt","size":0,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/login_status.txt","filename":"login_status.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/makemigrations.log","filename":"makemigrations.log","size":20,"category":"log"},{"path":"bundle/repro/evidence/run1/1.5.0/media_root_check.txt","filename":"media_root_check.txt","size":133,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/migrate.log","filename":"migrate.log","size":3931,"category":"log"},{"path":"bundle/repro/evidence/run1/1.5.0/modified_files.txt","filename":"modified_files.txt","size":22,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/outside_canary_value.txt","filename":"outside_canary_value.txt","size":52,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/pip_install.log","filename":"pip_install.log","size":278,"category":"log"},{"path":"bundle/repro/evidence/run1/1.5.0/request_auth_escape.txt","filename":"request_auth_escape.txt","size":180,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/request_chain_no_referer.txt","filename":"request_chain_no_referer.txt","size":169,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/request_chain_with_referer.txt","filename":"request_chain_with_referer.txt","size":226,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/request_inroot_referer.txt","filename":"request_inroot_referer.txt","size":248,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/response_auth_escape.txt","filename":"response_auth_escape.txt","size":53,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/response_chain_no_referer.txt","filename":"response_chain_no_referer.txt","size":0,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/response_chain_with_referer.txt","filename":"response_chain_with_referer.txt","size":53,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/response_inroot_referer.txt","filename":"response_inroot_referer.txt","size":47,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/server.log","filename":"server.log","size":469,"category":"log"},{"path":"bundle/repro/evidence/run1/1.5.0/server_observed_paths.txt","filename":"server_observed_paths.txt","size":143,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/status_auth_escape.txt","filename":"status_auth_escape.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/status_chain_no_referer.txt","filename":"status_chain_no_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/status_chain_with_referer.txt","filename":"status_chain_with_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/evidence/run1/1.5.0/status_inroot_referer.txt","filename":"status_inroot_referer.txt","size":4,"category":"other"},{"path":"bundle/repro/validation_verdict.json","filename":"validation_verdict.json","size":720,"category":"other"}]}