# Blocklist omission and malformation access bypass

Denylist entries missing, merged by string concatenation, or gated on config that can never be set

_Area: Web access control and IDOR. Seen in 3 disclosed reports; latest 2026-10-19. Updated 2026-10-24._

## How it works
A security control is built as a denylist or a config-gated backstop, and the assumption that it covers the dangerous surface breaks. Either an entry is absent, two entries fuse into one so neither matches, or the enforcement branch is gated on a value that no code path can populate. In each case the control looks present in review but never fires, so the endpoint or operation stays reachable.

## Where it shows up
- Denylists of endpoint paths or regexes, especially where entries are adjacent string literals [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-f8c7-rwf9-fmgm.md)
- Embedded servers (JupyterLab, kernels, terminals) secured only by a path blocklist [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rv4m-xm3f-3ccq.md)
- Security comments claiming enforcement next to a branch gated on a config field [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md)
- Config schemas or loaders that forbid the field the control reads [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md)
- Websocket handlers wrapped only for timeouts, not request filtering [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rv4m-xm3f-3ccq.md)
- Keyword classifiers that only inspect the first token of a query [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md)

## How to review
For each control, prove it can actually fire. For a denylist: enumerate every sensitive endpoint and confirm each has its own list element that matches a direct request; check for implicit string concatenation and missing commas [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-f8c7-rwf9-fmgm.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rv4m-xm3f-3ccq.md). For a config gate: trace every assignment site of the gating value and confirm the schema and loader permit it; an unreachable branch is fail-open [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md). The invariant: the set of blocked operations must equal the set of dangerous operations, and every enforcement branch must be reachable. Prefer allowlists over denylists where feasible.

## Variants seen
- Missing comma fuses two regex entries, leaving /api/terminals unblocked [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-f8c7-rwf9-fmgm.md)
- Endpoint simply absent from the blocklist (/api/kernels) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rv4m-xm3f-3ccq.md)
- Read-only backstop dead because config.readonly is never populated; only a first-keyword classifier remains [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md)

## Impact and severity
All three led to unauthenticated remote code execution or database writes: root OS shell [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-f8c7-rwf9-fmgm.md), arbitrary Python via kernels [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rv4m-xm3f-3ccq.md), writes and file read/exec through SQL functions [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md). Severity is high because the bypass needs no credentials and the control's presence masks the gap. Worse when the server is tokenless by default [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rv4m-xm3f-3ccq.md) and when the only remaining check is a shallow keyword filter [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-f8c7-rwf9-fmgm.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-rv4m-xm3f-3ccq.md