I was reviewing some SiteMinder APACHE 2.2 WebAgent configuration files when I came across '
%25u,%25U' in the list of ASCII/URL-encoded characters in the attribute
badurlchars as below:
[Wed Jun 19 2013 05:04:14] badurlchars='//,./,/.,/*,*.,~,\,%00-%1f,%7f-%ff,%25u,%25U'.
Basically the WebAgent will reject any request that contains the above characters in the URL occurring before the
Now I know that the
badurlchars attribute can contain the ASCII characters itself or the URL-encoded form of that character. [SiteMinder reference]
So what does '
%25u,%25U' signify in this case and why are they being placed in this list?
I guess finding out how these pose a security risk would also indirectly answer my question.
I came across this Debian bug report that talks about a bug in
xdg-open where URLs containing ampersands are parsed and an ampersand is converted into
%u which then gets encoded into
%25u. Now I am no Debian expert but could this be a security flaw that it would make sense to block
%25u in a URL?
I got a response saying that the characters
%25U refer to the ASCII Device Control Character EM (End Of Medium).
ASCII Character: EM HTML Entity Code:  Description: end of medium