# Validator-fetcher parser mismatch

Same URL or path checked by one parser and opened by another with different normalization rules

_Area: Web infrastructure and server-side requests. Seen in 4 disclosed reports; one confirmed bounty: $3,495; latest 2026-07-10. Updated 2026-11-01._

## How it works
A value is checked by one component and then opened or fetched by another that parses it differently. The validator sees a safe-looking string (a GitHub URL prefix, a `.lua` extension, a string path); the opener sees something else (an absolute local path, an NTFS alias, a non-string type). The assumption that breaks: "the thing I validated is the thing that gets opened." Any difference in normalization, scheme handling, type handling, or filesystem semantics between the two turns the check into decoration.

## Where it shows up
- A URL/path parameter validated by prefix or regex, then passed to a fetcher, `open()`, or path builder.
- A `//`-prefixed segment after a valid URL, which some parsers treat as an absolute-path anchor [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf.md).
- A path-validation helper present in one sibling function but missing in another that touches the same filesystem [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g5r6-gv6m-f5jv.md).
- Security checks that whitelist input types (string, Buffer) while the API also accepts `Uint8Array`, `ArrayBuffer`, `URL` [E3](https://bugbountylibrary.com/r/h1%3A2256167.md).
- Extension or suffix dispatch on Windows/NTFS, where `::$DATA`, trailing dot or trailing space resolve to the same file [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm6c-5j6x-hq8m.md).

## How to review
Identify both parsers: the one that validates and the one that opens/fetches. The invariant: the exact bytes the opener resolves must be the bytes the validator approved, under the opener's own normalization rules. Check:
- Does the validator normalize the same way the fetcher does (scheme, host, `//`, dot segments, case)?
- Is every filesystem-touching sibling calling the shared safe-path helper [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g5r6-gv6m-f5jv.md)?
- Are all accepted input types run through the check, not just string/Buffer [E3](https://bugbountylibrary.com/r/h1%3A2256167.md)?
- On Windows, does dispatch use the literal filename while `os.Open` canonicalizes it [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm6c-5j6x-hq8m.md)?

## How finders spotted it
- Reasoned a URL-fetch param on Cloud Run was SSRF-prone; after metadata/traversal were blocked, inferred validator and fetcher parse differently, then tested `//` as an absolute-path anchor [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf.md).
- Code reading: saw `validate_safe_path()` in `download_attachment()` but absent in `_upload_attachment_direct()` in the same file [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g5r6-gv6m-f5jv.md).
- Recognized prior fixes patched only strings and Buffers, then enumerated other accepted types like `Uint8Array` [E3](https://bugbountylibrary.com/r/h1%3A2256167.md).
- Noticed `filepath.Ext` does exact suffix matching while NTFS canonicalizes aliases, then traced the default branch to `os.Open` [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm6c-5j6x-hq8m.md).

## Variants seen
- URL-vs-filesystem: `//` suffix satisfies URL prefix check but anchors a local read [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf.md).
- Asymmetric helper use across sibling functions [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g5r6-gv6m-f5jv.md).
- Type mismatch: non-string path skips traversal check [E3](https://bugbountylibrary.com/r/h1%3A2256167.md).
- Filename alias mismatch: extension dispatch vs NTFS canonicalization [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm6c-5j6x-hq8m.md).

## Impact and severity
Ranged from arbitrary file read under the permission model [E3](https://bugbountylibrary.com/r/h1%3A2256167.md) to unauthenticated local file read of `/proc/self/environ`, escalating to live GCP credential compromise [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf.md), secret exfiltration via prompt-injected agents [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g5r6-gv6m-f5jv.md), and source disclosure leaking cookie/DB secrets enabling account takeover [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm6c-5j6x-hq8m.md). Impact rose when the read reached credentials or secrets and when no authentication was needed [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-g5r6-gv6m-f5jv.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-g5r6-gv6m-f5jv.md
- E3: https://bugbountylibrary.com/r/h1%3A2256167.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-mm6c-5j6x-hq8m.md