Colons in URLs: Safe?

Question

A friend asked me if it is relatively safe to click on the following link:

https://disq.us/url?url=https%3A%2F%2Farstechnica.co.uk%2Finformation-technology%2F2017%2F01%2Fantivirus-is-bad%2F%3Av0Er-2ea1-t4FcbndbRV_9xv5-4&cuid=977864

contained in the comment on this page:

https://betanews.com/2017/05/09/microsoft-fixes-crazy-bad-windows-vulnerability/#comment-3296284701

Taking a look at the link, I rewrote it to go directly to the article it was referencing, and provided my friend with the simplified link. (Note that I am neither condoning nor condemning any positions in the article itself.)

But taking a look at the original URL, you will notice it contains a colon in an uncommon position (the colon is encoded as %3A after bad%2F).

From a security standpoint, does that colon represent any hazards?

Also from a security standpoint, are there any serious hazards created if a user clicks on the original disq.us link above?

Answer 1

In HTTP(S) URLs, the : (in its direct form) has these purposes:

• delimiter between scheme and hier-part (http://example.com)
• delimiter between host and port (example.com:80)
• (deprecated) delimiter between name and password in userinfo (user:password@example.com)
• in the host, it may be part of IP addresses

In the path, the query, and the fragment, the : can be used to represent data. So there is no technical difference between a path like /hello and a path like /:hello.

In your example, it’s percent-encoded (as %3A). Any percent-encoded character can appear in the path/query/fragment, where it represents data.

_{(Terminology based on the URI standard)}

There is nothing problematic for security about : or %3A in the path/query/fragment, compared to any other character that can appear there. Whatever could be done with : (e.g., using it as prefix for a user tracking string) could as well be done with !, ;, etc.

---

What probably happens in your case (just a guess from observing the link/redirect, I have no experience with Disqus):

1. When a user posts an external link, Disqus doesn’t link it directly. Instead, they link to their own service http://disq.us/, which then redirects to the original URL.
2. Disqus adds the original URL as value for the url parameter (to which it adds a cryptic string prepended by :), and an ID as value for the cuid parameter.
   • The :-string is generated (and remembered) by Disqus (see point 3 for what it might be used).
   • The cuid indicates the Disqus account of the site owner where the comment with the external link was published (probably for analytics purposes).
3. For a specific original URL, the redirect only works if the disq.us URL contains the same :-string that was generated when the original URL was first submitted. This could prevent that their redirect service gets used for URLs that were never posted in a comment.

So clicking this link can affect your privacy, even if you have disabled sending of the Referer, and even if you don’t execute JavaScript:

• The linking site owner can know that you clicked their link.
• Disqus can know that you clicked this link (and on whose site, possibly also page).
• The linked site owner can know that you came from a link in a Disqus comment, and possibly also from which site/page (e.g., if the Disqus cuid can be found in a search engine).

To prevent this, you could extract the url parameter value, remove the last part prepended by (and including the) %3A, and percent-decode the result once. This allows you to visit the linked document directly, without going through Disqus’ redirect service. This works as long they decide to include the target URL in their redirect URL (which they wouldn’t have to).