Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reviewing some SiteMinder APACHE 2.2 WebAgent configuration files when I came across '%25u,%25U' in the list of ASCII/URL-encoded characters in the attribute badurlchars as below:

[Wed Jun 19 2013 05:04:14] badurlchars='//,./,/.,/*,*.,~,\,%00-%1f,%7f-%ff,%25u,%25U'.

Basically the WebAgent will reject any request that contains the above characters in the URL occurring before the '?' character.

Now I know that the badurlchars attribute can contain the ASCII characters itself or the URL-encoded form of that character. [SiteMinder reference]

So what does '%25u,%25U' signify in this case and why are they being placed in this list? I guess finding out how these pose a security risk would also indirectly answer my question.


I came across this Debian bug report that talks about a bug in xdg-open where URLs containing ampersands are parsed and an ampersand is converted into %u which then gets encoded into %25u. Now I am no Debian expert but could this be a security flaw that it would make sense to block %25u in a URL?


I got a response saying that the characters %25u/%25U refer to the ASCII Device Control Character EM (End Of Medium).

From w3schools:

ASCII Character:  EM
HTML Entity Code: 
Description:      end of medium

Quick note: ASCII character % (37 in decimal) is represented as %25 (hexadecimal) after percent encoding. [Reference1] [Reference2]

share|improve this question

I believe what you are looking at is an attempt to defeat a Canonicalization Attack where an attacker attempts to embed encoded characters into a URL or other input value, such that it may be missed by security filters, read into the system, decoded, and then used for ill intent. these kinds of attacks are usually used to navigate to places that should not be accessible or inject bad input.

see more here:,_locale_and_Unicode

share|improve this answer
it might be slightly broader... I found this where %25u is used in a Youtube search to force a search for a Japanese text character, via the hex code for the Unicode version of the Japanese text... and %25u is what the search string needs to decode the hex – Bon Gart Jul 9 '13 at 16:33
+1. Thanks Frank and @BonGart. – Kent Pawar Jul 12 '13 at 16:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.