URL CGI parameters are malformed in ICAP with BlueCoat


  • Description
    Proxy chain with BlueCoat ICAP client and specific BlueCoat SGOS modifies URLs incorrectly.

  • Symptoms
    When special characters are used as a part of search item and/or serve as  part of url-cgi parameters, the resulting URLs may be wrong or malformed.

  • Cause
    This behavior occurs due to SGOS recursively percent-encoding the percent sign (%) in percent-encoded characters that are embedded in the URL. In other words, the percent sign in percent-encoded characters is replaced with "%25". For example, "%2B" (percent-encoded plus sign), will become "%252B"

    Lets review search query for "Finjan+Business" with the Google through this proxy chain:



    The search results for this query are as following:



    To find the modifications for URL parameters in this example review the network traffic:



    Packet #1128
    A client (10.194.150.155) issues a request to the BlueCoat (10.194.150.80) :
    HTTP GET  http://www.google.com/search?hl=en&q=Finjan%2BBusiness&btnG=Google+Search

    Packet #1130
    Blue Coat (10.194.150.80) modifies it and forwards a modified request to Finjan (10.194.150.117) :
    GET  http://www.google.com/search?hl=en&q=Finjan%252BBusiness&btnG=Google+Search

    Packet #1133
    Finjan (10.194.150.117) proceeds with the (wrong) request to the WebServer :
    HTTP GET  /search?hl=en&q=Finjan%2BBusiness&btnG=Google+Search

  • Solution
    This behavior occurs when Blue Coat is running SGOS 4.2.4.x series.
    Blue Coat technical support confirmed that this issue is scheduled to be resolved in SGOS 4.2.4.10 release.

    In several cases solution for this behavior is to wrap such special characters with the spaces:



    This search request is treated as expected :



    And these are the results :


  • Software Version
    N/A<

  • This article applies to:
    NG 1000
    NG 5000
    NG 6000
    NG 8000
    This article was previously published as:
    Finjan KB 1550

    Last Modified 3/23/2009.
    https://support.trustwave.com/kb/KnowledgebaseArticle13397.aspx