* and don't send any authentication credentials.

This type of attack is mainly relevant when:

* the application is running locally (e.g. on `localhost`) or in an internal network
* and the application doesn't have any authentication, it expects that any request from the same network can be trusted.

## Example Attack { #example-attack }

Imagine you build a way to run a local AI agent.

It provides an API at

```

            for (String keyword : query.split(" ")) {
                if (keyword.equals("AND")) {
                    continue;
                }
                assertTrue(
                        doc.entrySet()
                                .stream()
                                .anyMatch(entry -> entry.getValue().toString().toLowerCase().contains(keyword.toLowerCase())),

   *
   * @since 29.0
   */
  ElementOrder<N> incidentEdgeOrder();

  /**
   * Returns a live view of this graph as a {@link Network} whose edges {@code E} are {@code
   * EndpointPair<N>} objects (that is, a {@code Network<N, EndpointPair<N>>}). The resulting {@code
   * Network}'s edge-oriented methods (such as {@code inEdges()}) will return views transformed from

public interface MetadataResolutionRequest extends RepositoryRequest {

    /**
     * Indicates whether network access to remote repositories has been disabled.
     *
     * @return {@code true} if remote access has been disabled, {@code false} otherwise.
     */
    @Override
    boolean isOffline();

    /**
     * Enables/disables network access to remote repositories.
     *

  /**
   * Non-null if this response is a successful upgrade ...
   */
  @get:JvmName("socket") val socket: Socket?,
  /**
   * Returns the raw response received from the network. Will be null if this response didn't use
   * the network, such as when the response is fully cached. The body of the returned response
   * should not be read.
   */
  @get:JvmName("networkResponse") val networkResponse: Response?,
  /**

import okhttp3.internal.toHostHeader
import okio.GzipSource
import okio.buffer

/**
 * Bridges from application code to network code. First it builds a network request from a user
 * request. Then it proceeds to call the network. Finally it builds a user response from the network
 * response.
 */
class BridgeInterceptor : Interceptor {
  @Throws(IOException::class)

    /**
     * Create channel information
     *
     * @param channelId unique channel identifier
     * @param transport SMB transport for this channel
     * @param localInterface local network interface
     * @param remoteInterface remote network interface
     */
    public ChannelInfo(String channelId, SmbTransport transport, NetworkInterfaceInfo localInterface,
            NetworkInterfaceInfo remoteInterface) {

            0, null, null, false, null, null, null, null, null, false);
    protected final ColumnInfo _columnUpdatedBy = cci("updatedBy", "updatedBy", null, null, String.class, "updatedBy", null, false, false,
            false, "keyword", 0, 0, null, null, false, null, null, null, null, null, false);

	case strings.Contains(err.Error(), "server closed idle connection"):
		return true
	}

	return false
}

// Converts network error to storageErr. This function is
// written so that the storageAPI errors are consistent
// across network disks.
func toStorageErr(err error) error {
	if err == nil {
		return nil
	}

	if isNetworkError(err) {
		return errDiskNotFound
	}

        int access = 123;

        doThrow(new IOException("Network error")).when(mockDcerpcHandle).sendrecv(any(MsrpcLsarOpenPolicy2.class));

        // Act & Assert
        IOException thrown = assertThrows(IOException.class, () -> {
            new LsaPolicyHandle(mockDcerpcHandle, server, access);
        });

        assertEquals("Network error", thrown.getMessage());