Double quotation (") is encoded to "%22" in accesslog.

Products

• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

Sometimes any access log record shows "%22". What is this?

Here is actual example.
date time time-taken c-ip cs-username cs-auth-group s-supplier-name s-supplier-ip s-supplier-country s-supplier-failures x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent).......

2021-10-14 02:33:14 2 10.92.195.148 - - 10.92.195.145 10.92.195.145 "None" - - OBSERVED "none" -  200 TCP_NC_MISS GET text/html http 10.92.195.145 80 / - - "hoge%22" ...

This example request sends custom User-Agent with " character to ProxySG.
curl -x 10.92.195.141:8080 -A "hoge\"" http://10.92.195.145

 

Cause

This is encoded by Proxy SG Accesslog process because double quotation (") is reserved by Access log. If this character comes in to the SG with request/response and need to write accesslog, it is encoded to %22. 

Resolution

No resolution. This is expected behavior.