CAIN-42 CAIN StudioPath rules
A credential is for an exact path. If BROKER and the downstream server read a path differently, a credential for an allowed path can reach a forbidden one. So these are refused, when minting and when verifying:
| Pattern | Why | Since |
|---|---|---|
%2e, %2f, %5c, %00, a backslash | Encoded dot, slash or backslash: decoded later, they can climb out of the granted path | 2026-10-27 |
; in the path | Tomcat and Jetty treat ; as a path parameter: /orders/..;/admin reaches /admin | 2026-11-02 |
%25 in the path | Double encoding: %252e becomes %2e becomes . on a server that decodes twice | 2026-11-02 |
| Non-ASCII characters in the path | Full-width dots and other look-alikes are normalised to . by some stacks | 2026-11-02 |
| Control characters anywhere | CR, LF, tab and others confuse parsers and logs | 2026-11-02 |
../ segments are resolved before the grant check, so /orders/A-1/../../admin is judged as /admin
(denied). A ; in the query string is allowed.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.