Parser and control bypass reference

Request Body Parser Disagreement

Test whether gateway, schema validator, framework, and application handler disagree about body format, duplicate keys, charset, or method override. Use inert markers and reversible operations on controlled records.

content-typejsonformparserapi

Stable IDbypass:request-body-parsingSource record date2026-08-20Human reviewNot recordedProvenanceCurated reference

Compare behaviorA bypass claim needs a control request and a clear boundary that changed.

Stop after confirmation. Do not escalate impact without separate authorization.

Declared type versus body shape

Keep the logical marker constant while changing only Content-Type and serialization. A successful parse is not a security issue unless it crosses a documented control.

application/json | {"marker":"alpha"}
application/x-www-form-urlencoded | marker=alpha
text/plain | {"marker":"alpha"}

Duplicate key interpretation

Different parsers may keep the first value, last value, array, or error. Compare a harmless field and preserve raw requests and application state.

{"marker":"alpha","marker":"beta"}
marker=alpha&marker=beta

Method override boundary

Check override headers or fields only when the application already uses them. A changed method must be tied to an authorization or validation difference.

X-HTTP-Method-Override: PATCH
_method=PATCH

Evidence gate

Require a paired request that crosses validation, authorization, or integrity expectations while the original serialization is rejected or constrained.

baseline serialization + one parser variant + state readback

Version history: normalized permanent page created 2026-08-20.