{ "timestamp": "2026-09-24T13:50:31.080013+00:00", "platform": "macOS-15.7.4-arm64-arm-64bit-Mach-O", "python": "3.14.7 (main, Aug 5 2026, 10:29:49) [Clang 17.0.0 (clang-1700.6.4.2)]", "curl": "curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0\nRelease-Date: 2024-03-27\nProtocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp\nFeatures: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM SPNEGO SSL threadsafe UnixSockets\n", "synthetic_only": true, "network_scope": "127.0.0.1 only; server never forwards or resolves target", "cases": [ { "name": "shell-expanded", "shell_command": "exec python3 credential_fixture.py --wrapper /usr/bin/curl --disable --silent --show-error --fail --noproxy '' --proxy \"$PROXY_URL\" --proxy-user \"$PROXY_USERNAME:$PROXY_PASSWORD\" --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "argv_before_curl_exec": [ "--disable", "--silent", "--show-error", "--fail", "--noproxy", "", "--proxy", "http://127.0.0.1:62603", "--proxy-user", "fixture-user:synthetic-only-@:$ space '{{literal}}'", "--connect-timeout", "2", "--max-time", "5", "http://fixture.invalid/check" ], "password_in_pre_exec_argv": true, "password_in_environment": true, "running_curl_ps_command": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62603 --proxy-user --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "running_curl_ps_with_environment": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62603 --proxy-user --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "password_visible_to_own_user_ps_environment": false, "password_in_running_ps": false, "returncode": 0, "stdout": "synthetic-auth-ok\n", "stderr": "", "requests": [ { "method": "GET", "target": "http://fixture.invalid/check", "authorization": "Basic Zml4dHVyZS11c2VyOnN5bnRoZXRpYy1vbmx5LUA6JCBzcGFjZSAne3tsaXRlcmFsfX0n" } ] }, { "name": "curl-internal", "shell_command": "exec python3 credential_fixture.py --wrapper /usr/bin/curl --disable --silent --show-error --fail --noproxy '' --proxy \"$PROXY_URL\" --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user '{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}' --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "argv_before_curl_exec": [ "--disable", "--silent", "--show-error", "--fail", "--noproxy", "", "--proxy", "http://127.0.0.1:62605", "--variable", "%PROXY_USERNAME", "--variable", "%PROXY_PASSWORD", "--expand-proxy-user", "{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}", "--connect-timeout", "2", "--max-time", "5", "http://fixture.invalid/check" ], "password_in_pre_exec_argv": false, "password_in_environment": true, "running_curl_ps_command": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62605 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "running_curl_ps_with_environment": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62605 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "password_visible_to_own_user_ps_environment": false, "password_in_running_ps": false, "returncode": 0, "stdout": "synthetic-auth-ok\n", "stderr": "", "requests": [ { "method": "GET", "target": "http://fixture.invalid/check", "authorization": "Basic Zml4dHVyZS11c2VyOnN5bnRoZXRpYy1vbmx5LUA6JCBzcGFjZSAne3tsaXRlcmFsfX0n" } ] }, { "name": "curl-internal-missing-password", "shell_command": "exec python3 credential_fixture.py --wrapper /usr/bin/curl --disable --silent --show-error --fail --noproxy '' --proxy \"$PROXY_URL\" --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user '{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}' --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "argv_before_curl_exec": [ "--disable", "--silent", "--show-error", "--fail", "--noproxy", "", "--proxy", "http://127.0.0.1:62608", "--variable", "%PROXY_USERNAME", "--variable", "%PROXY_PASSWORD", "--expand-proxy-user", "{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}", "--connect-timeout", "2", "--max-time", "5", "http://fixture.invalid/check" ], "password_in_pre_exec_argv": false, "password_in_environment": false, "running_curl_ps_command": null, "running_curl_ps_with_environment": null, "password_visible_to_own_user_ps_environment": null, "password_in_running_ps": null, "returncode": 2, "stdout": "", "stderr": "curl: option --variable: variable expansion failure\ncurl: try 'curl --help' or 'curl --manual' for more information\n", "requests": [] }, { "name": "curl-internal-empty-password", "shell_command": "exec python3 credential_fixture.py --wrapper /usr/bin/curl --disable --silent --show-error --fail --noproxy '' --proxy \"$PROXY_URL\" --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user '{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}' --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "argv_before_curl_exec": [ "--disable", "--silent", "--show-error", "--fail", "--noproxy", "", "--proxy", "http://127.0.0.1:62609", "--variable", "%PROXY_USERNAME", "--variable", "%PROXY_PASSWORD", "--expand-proxy-user", "{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}", "--connect-timeout", "2", "--max-time", "5", "http://fixture.invalid/check" ], "password_in_pre_exec_argv": false, "password_in_environment": false, "running_curl_ps_command": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62609 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "running_curl_ps_with_environment": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62609 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 2 --max-time 5 http://fixture.invalid/check", "password_visible_to_own_user_ps_environment": false, "password_in_running_ps": false, "returncode": 0, "stdout": "synthetic-auth-ok\n", "stderr": "", "requests": [ { "method": "GET", "target": "http://fixture.invalid/check", "authorization": "Basic Zml4dHVyZS11c2VyOg==" } ] }, { "name": "curl-internal-connect-rejection", "shell_command": "exec python3 credential_fixture.py --wrapper /usr/bin/curl --disable --silent --show-error --fail --noproxy '' --proxy \"$PROXY_URL\" --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user '{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}' --connect-timeout 2 --max-time 5 https://example.com/", "argv_before_curl_exec": [ "--disable", "--silent", "--show-error", "--fail", "--noproxy", "", "--proxy", "http://127.0.0.1:62611", "--variable", "%PROXY_USERNAME", "--variable", "%PROXY_PASSWORD", "--expand-proxy-user", "{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}", "--connect-timeout", "2", "--max-time", "5", "https://example.com/" ], "password_in_pre_exec_argv": false, "password_in_environment": true, "running_curl_ps_command": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62611 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 2 --max-time 5 https://example.com/", "running_curl_ps_with_environment": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62611 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 2 --max-time 5 https://example.com/", "password_visible_to_own_user_ps_environment": false, "password_in_running_ps": false, "returncode": 22, "stdout": "", "stderr": "curl: (22) HTTP response code said error\n", "requests": [ { "method": "CONNECT", "target": "example.com:443", "authorization": "Basic Zml4dHVyZS11c2VyOnN5bnRoZXRpYy1vbmx5LUA6JCBzcGFjZSAne3tsaXRlcmFsfX0n" } ] }, { "name": "curl-internal-connect-rejection-without-fail", "shell_command": "exec python3 credential_fixture.py --wrapper /usr/bin/curl --disable --silent --show-error --noproxy '' --proxy \"$PROXY_URL\" --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user '{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}' --connect-timeout 2 --max-time 5 https://example.com/", "argv_before_curl_exec": [ "--disable", "--silent", "--show-error", "--noproxy", "", "--proxy", "http://127.0.0.1:62613", "--variable", "%PROXY_USERNAME", "--variable", "%PROXY_PASSWORD", "--expand-proxy-user", "{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}", "--connect-timeout", "2", "--max-time", "5", "https://example.com/" ], "password_in_pre_exec_argv": false, "password_in_environment": true, "running_curl_ps_command": "/usr/bin/curl --disable --silent --show-error --noproxy --proxy http://127.0.0.1:62613 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 2 --max-time 5 https://example.com/", "running_curl_ps_with_environment": "/usr/bin/curl --disable --silent --show-error --noproxy --proxy http://127.0.0.1:62613 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 2 --max-time 5 https://example.com/", "password_visible_to_own_user_ps_environment": false, "password_in_running_ps": false, "returncode": 56, "stdout": "", "stderr": "curl: (56) CONNECT tunnel failed, response 407\n", "requests": [ { "method": "CONNECT", "target": "example.com:443", "authorization": "Basic Zml4dHVyZS11c2VyOnN5bnRoZXRpYy1vbmx5LUA6JCBzcGFjZSAne3tsaXRlcmFsfX0n" } ] }, { "name": "published-baseline-connect-rejection", "shell_command": "exec python3 credential_fixture.py --wrapper /usr/bin/curl --disable --silent --show-error --fail --noproxy '' --proxy \"$PROXY_URL\" --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user '{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}' --connect-timeout 10 --max-time 30 --output /dev/null --write-out 'http=%{http_code} connect=%{http_connect} seconds=%{time_total}\\n' https://example.com/", "argv_before_curl_exec": [ "--disable", "--silent", "--show-error", "--fail", "--noproxy", "", "--proxy", "http://127.0.0.1:62615", "--variable", "%PROXY_USERNAME", "--variable", "%PROXY_PASSWORD", "--expand-proxy-user", "{{PROXY_USERNAME}}:{{PROXY_PASSWORD}}", "--connect-timeout", "10", "--max-time", "30", "--output", "/dev/null", "--write-out", "http=%{http_code} connect=%{http_connect} seconds=%{time_total}\\n", "https://example.com/" ], "password_in_pre_exec_argv": false, "password_in_environment": true, "running_curl_ps_command": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62615 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 10 --max-time 30 --output /dev/null --write-out http=%{http_code} connect=%{http_connect} seconds=%{time_total}\\n https://example.com/", "running_curl_ps_with_environment": "/usr/bin/curl --disable --silent --show-error --fail --noproxy --proxy http://127.0.0.1:62615 --variable %PROXY_USERNAME --variable %PROXY_PASSWORD --expand-proxy-user --connect-timeout 10 --max-time 30 --output /dev/null --write-out http=%{http_code} connect=%{http_connect} seconds=%{time_total}\\n https://example.com/", "password_visible_to_own_user_ps_environment": false, "password_in_running_ps": false, "returncode": 22, "stdout": "http=000 connect=407 seconds=0.005328\n", "stderr": "curl: (22) HTTP response code said error\n", "requests": [ { "method": "CONNECT", "target": "example.com:443", "authorization": "Basic Zml4dHVyZS11c2VyOnN5bnRoZXRpYy1vbmx5LUA6JCBzcGFjZSAne3tsaXRlcmFsfX0n" } ] } ], "checks": { "shell_expansion_passes_password_as_argument": true, "internal_expansion_avoids_password_argument": true, "both_forms_authenticate_identical_special_characters": true, "both_retain_password_in_environment": true, "missing_variable_fails_before_network": true, "empty_variable_is_accepted": true, "connect_rejection_with_fail_is_22": true, "connect_rejection_without_fail_is_56": true, "published_baseline_exits_22_and_reports_connect407": true }, "passed": 9, "total": 9, "publication_note": "Synthetic credentials only. Local Python/script paths in shell_command and temporary recorder paths in ps environment fields are replaced; measured argv, statuses and checks are unchanged." }