=== Horilla Protected Media Composed Chain Reproduction ===
Started at: 2026-07-27T00:29:56Z

Using cached repo at /pruva/project-cache/repo

========== RUN 1 ==========
Run 1 started at: 2026-07-27T00:29:57Z
  Checked out 1.5.0 → 61bd5173220d19925ad8220db9152a75c881ea73
  Outside canary: OUTSIDE_ROOT_CANARY_3a2d45a9e6442b46d260066629134c27
  In-root canary: INROOT_CANARY_9505ab53c7a5ee324a512430356397d1
--- Ref 1.5.0 (both defects present) — Run 1 ---
  Created low-priv user (is_staff=False, is_superuser=False)
  Server ready on port 18099 (PID 13013)
  PASS: chain_no_referer_denied — expected=302 actual=302 (unauthenticated, no Referer)
  PASS: chain_no_referer_no_canary — expected=true actual=true (outside canary absent)
  PASS: chain_with_referer_200 — expected=200 actual=200 (unauthenticated, Referer=/login)
  PASS: chain_with_referer_canary — expected=true actual=true (outside canary present)
  Login status: 302
  PASS: auth_escape_200 — expected=200 actual=200 (authenticated low-priv, no Referer)
  PASS: auth_escape_canary — expected=true actual=true (outside canary present via auth)
  PASS: inroot_referer_200 — expected=200 actual=200 (unauthenticated, Referer=/login)
  PASS: inroot_referer_canary — expected=true actual=true (in-root canary present)
  Checked out 67ac2056813ee95d4c4a0bfe7c0124a361cb6c48 → 67ac2056813ee95d4c4a0bfe7c0124a361cb6c48
  Outside canary: OUTSIDE_ROOT_CANARY_55c158311bd100aa6f860706850e1ab5
  In-root canary: INROOT_CANARY_a8d2744ac9c0e02eba78560d53ebc744
--- Ref 67ac2056 (traversal fixed, Referer still trusted) — Run 1 ---
  Server ready on port 18099 (PID 13409)
  PASS: trav_fixed_chain_404 — expected=404 actual=404 (safe_join blocks traversal)
  PASS: trav_fixed_inroot_200 — expected=200 actual=200 (Referer bypass still works)
  PASS: trav_fixed_inroot_canary — expected=true actual=true (in-root canary present)
  Checked out 1.6.0 → b3bd29d15819cbece45c58e6268ddd0614e387d6
  Outside canary: OUTSIDE_ROOT_CANARY_8e8b4165c022f956bac13bbc91c93589
  In-root canary: INROOT_CANARY_0f450aa46790b4c02b06c1d70c8c4525
--- Ref 1.6.0 (both fixed) — Run 1 ---
  Created low-priv user (is_staff=False, is_superuser=False)
  Server ready on port 18099 (PID 13736)
  PASS: fixed_chain_404 — expected=404 actual=404 (safe_join blocks traversal)
  PASS: fixed_inroot_denied — expected=302 actual=302 (no Referer bypass)
  PASS: fixed_inroot_no_canary — expected=true actual=true (in-root canary absent)
  Login status: 302
  PASS: fixed_auth_inroot_200 — expected=200 actual=200 (authenticated, service works)
  PASS: fixed_auth_inroot_canary — expected=true actual=true (in-root canary via auth)

Run 1 complete.

========== RUN 2 ==========
Run 2 started at: 2026-07-27T00:33:30Z
  Checked out 1.5.0 → 61bd5173220d19925ad8220db9152a75c881ea73
  Outside canary: OUTSIDE_ROOT_CANARY_d47b8127bf8fd9a2b60dde6756088032
  In-root canary: INROOT_CANARY_7430d625cf437674a7218ab25fe7f8de
--- Ref 1.5.0 (both defects present) — Run 2 ---
  Created low-priv user (is_staff=False, is_superuser=False)
  Server ready on port 18099 (PID 14101)
  PASS: chain_no_referer_denied — expected=302 actual=302 (unauthenticated, no Referer)
  PASS: chain_no_referer_no_canary — expected=true actual=true (outside canary absent)
  PASS: chain_with_referer_200 — expected=200 actual=200 (unauthenticated, Referer=/login)
  PASS: chain_with_referer_canary — expected=true actual=true (outside canary present)
  Login status: 302
  PASS: auth_escape_200 — expected=200 actual=200 (authenticated low-priv, no Referer)
  PASS: auth_escape_canary — expected=true actual=true (outside canary present via auth)
  PASS: inroot_referer_200 — expected=200 actual=200 (unauthenticated, Referer=/login)
  PASS: inroot_referer_canary — expected=true actual=true (in-root canary present)
  Checked out 67ac2056813ee95d4c4a0bfe7c0124a361cb6c48 → 67ac2056813ee95d4c4a0bfe7c0124a361cb6c48
  Outside canary: OUTSIDE_ROOT_CANARY_741d90b92d58f72738b294357eeda75b
  In-root canary: INROOT_CANARY_f07697d0d4720fbce6f4b7345cea95b8
--- Ref 67ac2056 (traversal fixed, Referer still trusted) — Run 2 ---
  Server ready on port 18099 (PID 14428)
  PASS: trav_fixed_chain_404 — expected=404 actual=404 (safe_join blocks traversal)
  PASS: trav_fixed_inroot_200 — expected=200 actual=200 (Referer bypass still works)
  PASS: trav_fixed_inroot_canary — expected=true actual=true (in-root canary present)
  Checked out 1.6.0 → b3bd29d15819cbece45c58e6268ddd0614e387d6
  Outside canary: OUTSIDE_ROOT_CANARY_aa09208090d3ef9df64ce15f4646521d
  In-root canary: INROOT_CANARY_6648f2343091d884ee8636ad9397ba60
--- Ref 1.6.0 (both fixed) — Run 2 ---
  Created low-priv user (is_staff=False, is_superuser=False)
  Server ready on port 18099 (PID 14761)
  PASS: fixed_chain_404 — expected=404 actual=404 (safe_join blocks traversal)
  PASS: fixed_inroot_denied — expected=302 actual=302 (no Referer bypass)
  PASS: fixed_inroot_no_canary — expected=true actual=true (in-root canary absent)
  Login status: 302
  PASS: fixed_auth_inroot_200 — expected=200 actual=200 (authenticated, service works)
  PASS: fixed_auth_inroot_canary — expected=true actual=true (in-root canary via auth)

Run 2 complete.

========== SUMMARY ==========
Total tests: 32
Passed tests: 32
All passed: true

RESULT: All tests passed — vulnerability confirmed.