URI Delimiters & Parsing Differences

uri_delimiters_quirks.md

URI Delimiters & Parsing Differences

---

🌐 Standard URI Delimiters (RFC 3986)

Delimiter	Purpose
?	Start query string
&	Query param separator
=	Key-value separator
#	Fragment (client-side only)
/	Path separator
:	Scheme separator
@	Userinfo separator
;	Path parameter delimiter (legacy)

---

⚠️ Interesting / Abused Delimiters

Delimiter	Use	Security Relevance
;	Path / matrix params	Filter bypass
,	List separator	Parsing inconsistencies
`	`	Legacy systems	WAF bypass
%26	Encoded &	Double parsing
%3B	Encoded ;	Filter bypass
%23	Encoded #	Fragment confusion

---

🧠 Framework-Specific Behavior

Spring Framework

• Supports matrix variables using ;

Example:

/users;id=1;role=admin

---

Ruby on Rails

• May treat ; as param separator

Example:

/users?id=1;role=admin

---

Express.js (Node.js)

• Uses &
• Supports nested params via qs

Example:

?id=1&role=admin
?id[]=1&id[]=2

---

PHP

• Supports & and ;

Example:

?id=1;role=admin

---

Django / Flask

• Strict: only &

---

ASP.NET

• Uses &
• May tolerate ; in legacy configs

---

Go (net/http)

• Strict parsing (& only)

---

Java Servlets (Tomcat)

• Supports ; (JSESSIONID)

Example:

/app;jsessionid=XYZ?id=1

---

🔥 Reverse Proxy / WAF Differences

NGINX

• Treats ; as part of URI

Apache

• Config-dependent behavior

Cloudflare (WAF)

• Often normalizes & only

---

⚔️ Attack Patterns

1. Parameter Pollution

?id=1&role=user;role=admin

---

2. WAF Bypass

?id=1%3Brole=admin

---

3. Cache Poisoning

?id=1;admin=true

---

4. Auth Bypass

/api?user=guest;user=admin

---

🧪 Testing Checklist

Alternate Separators

&
;
,
|

Encoded Variants

%26
%3B
%2C
%7C

Mixed Payloads

?id=1&role=user;role=admin
?id=1;role=admin&debug=true

Duplicate Params

?id=1&id=2

---

🧠 Key Insight

Different systems parse URLs differently → leads to vulnerabilities.

---

🔚 TL;DR

• & = standard
• ; = dangerous
• Encoding = bypass tool
• Exploits = parser mismatch