URL Parser Fuzzing

TLDR: There are generally two main standards for URL parsing, RFC 3986 and WHATWG. Among the languages tested, Rust and Node.js generally follow the WHATWG standard, while Go and Python tend to follow RFC 3986. In my research I found when different components of a system rely on different parsing standards, these inconsistencies can create enough of a parsing differential to bypass filtering performed by one component while causing another component to interpret the same input differently. When both components follow the same standard, however, the available parsing differentials are typically much more limited.

You can view the source of the Differential Fuzzer in my Github

random parsing differentials

Did you know?

Go / NodeMissing delimiters

http:evil.com

Nodefinds the host evil.com and uses / as the path.

Gofinds no host and treats evil.com as an opaque path.

Rust / PythonBackslash handling

http:\\example.com\hello

Rustnormalizes backslashes into delimiters and finds example.com.

Pythonkeeps the backslashes in the path and finds no host.

Go / NodeUnicode hostname

http://example．com/

Nodenormalizes the fullwidth dot and reads example.com.

Gokeeps the fullwidth character in the hostname.

Node / PythonEncoded dot-segments

http://example.com/.%2e/

Noderecognizes .%2e as .. and normalizes the path to /.

Pythonleaves /.%2e/ unchanged.

Rust / NodeFile URLs

file://example.com/c:/hello

Rustdrops the hostname before a Windows drive segment.

Nodekeeps example.com because it only drops localhost here.

Python / GoUserinfo decoding

http://user:p%40ss.example.com

Godecodes the password to p@ss.

Pythonkeeps the encoded password p%40ss.

Rust / GoQuery encoding

http://example.com/path?query bar

Rustpercent-encodes the space as query%20bar.

Gokeeps query bar raw.

Go / NodeControl characters

http://exmp.com/#hello\n\rSet-Cookie: evil

Nodestrips CR/LF and percent-encodes the fragment space.

Gokeeps the CR/LF and space raw in the fragment.

Node / PythonInternational URLs

http://bücher.example/café?q=✓#résumé

Nodeuses Punycode for the host and percent-encodes the rest.

Pythonkeeps the Unicode characters raw.

Rust / GoIPv4 forms

http://2130706433/a

Rustinterprets the decimal integer as 127.0.0.1.

Gokeeps 2130706433 as the hostname.

Explore all differentials