99% of URL parsers disagree with each other [pdf]

Researchers developed TURLMOIL, a probabilistic context-free grammar fuzzer, to evaluate 96 URL parsers across 21 language ecosystems. The study found that 99.91% of parser pairs disagree on at least one component, demonstrating that shared standards do not ensure interoperability or security. Furthermore, the team successfully utilized parser differentials to fingerprint black-box systems and uncover six vulnerabilities in deployed software such as Jenkins and MediaWiki. Open article →