What are the risks of allowing quote characters as part of a URL parameter?

Question

I need to allow the user to submit queries as follows;

/search/"my search string"

but it's failing because of request validation, as outlined in the following 2 questions:

How to include quote characters as a route parameter? Getting "Illegal characters in path" message

How to modify request validation?

I'm currently trying to figure out how to disable request validation for the quote character, but i'd like to know the risks before I actually put the site live with this disabled? I will not disable the request validation unless I can only disable it for the quote character, so I do intend to disallow every other character that's currently not allowed.

Answer 1

According to the URI generic syntax specification (RFC 2396), the double-quote character is explicitly excluded and must be escaped (i.e. %22). See section 2.4.3. The reason given in the spec:

The angle-bracket "<" and ">" and double-quote (") characters are excluded because they are often used as the delimiters around URI in text documents and protocol fields.

You can see easily why this is the case -- imagine trying to create a link in HTML to your URL:

<a href="http://somesite/search/"my search string""/>

That would fail HTML parsing (and also breaks SO's syntax highlighting). You also would have trouble doing basic things with the URL like emailing it to someone (the email client wouldn't parse the URL correctly), posting it on a message board, sending it in an instant message, etc.

For what it's worth, spaces are also explicitly excluded (same section of the RFC explains why).