# Bro's escaping of non-printable characters behaves unexpected **URL:** \ **Category:** Zeek\ **Created:** [February 18, 2015, 12:20am UTC](https://community.zeek.org/t/bros-escaping-of-non-printable-characters-behaves-unexpected/3494 "2015-02-18T00:20:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Paul\_Pearce](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@Paul\_Pearce](https://community.zeek.org/u/Paul_Pearce)\ **Post date:** [February 18, 2015, 12:20am UTC](https://community.zeek.org/t/bros-escaping-of-non-printable-characters-behaves-unexpected/3494/1 "2015-02-18T00:20:18Z")
Hello everyone, I'm encountering a problem where I am unable to reconstruct original inputs from bro log files. This example summarizes the problem: ---
**Author:** ![Paul\_Pearce](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@Paul\_Pearce](https://community.zeek.org/u/Paul_Pearce)\ **Post date:** [February 18, 2015, 1:15am UTC](https://community.zeek.org/t/bros-escaping-of-non-printable-characters-behaves-unexpected/3494/2 "2015-02-18T01:15:31Z")
Hello, That was a poor example, as it used \0 which is special cased by the bro escape functionality. This problem also extends beyond non-printable to non-ascii (unicode) characters. Here's another example with a unicode character for the registered sign ® (\xc2\xae). ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [February 18, 2015, 2:12am UTC](https://community.zeek.org/t/bros-escaping-of-non-printable-characters-behaves-unexpected/3494/3 "2015-02-18T02:12:22Z")
Hello Paul, I think the reason that the ascii writer of the logging framework of Bro does not support arbitrary binary data is, that it was conceived as a framework for writing human-readable log files, not arbitrary binary data. If you want to write binary data to log files, I would recommend just base64-encoding it before using the encode\_base64 bif. If you are ok with just using the standard methods for writing to files outside of the logging framework, you can put them into binary mode, as you probably are aware. Johanna ---
**Author:** ![Paul\_Pearce](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@Paul\_Pearce](https://community.zeek.org/u/Paul_Pearce)\ **Post date:** [February 18, 2015, 5:15am UTC](https://community.zeek.org/t/bros-escaping-of-non-printable-characters-behaves-unexpected/3494/4 "2015-02-18T05:15:08Z")
Hey Johanna, Thanks for taking the time to respond. > I think the reason that the ascii writer of the logging framework of Bro > does not support arbitrary binary data is, that it was conceived as a > framework for writing human-readable log files, not arbitrary binary data. I'm going to push back a bit on characterizing this as supporting arbitrary binary data. These are unicode characters appearing in URIs ($http$URI) that I'm encountering in actual network traffic. I'm actually encountering them somewhat frequently. The problem manifests itself in the standard http.log, as well as the extensions I'm working on. I realize the RFC does not permit unicode in URLs, but given that they do occur in practice (browsers will just silently handle them), this seems like something worth supporting. I'll also point out that Bro's ascii logging facilities do currently support logging these characters, they simply do so in an unrecoverable/non-canonical way. What I'm proposing is standardization/cleanup for the escaping that Bro already performs. Thanks. -Paul ---
**Author:** ![Christian\_Struck](https://avatars.discourse-cdn.com/v4/letter/c/e19adc/32.png) [@Christian\_Struck](https://community.zeek.org/u/Christian_Struck)\ **Post date:** [February 18, 2015, 1:22pm UTC](https://community.zeek.org/t/bros-escaping-of-non-printable-characters-behaves-unexpected/3494/5 "2015-02-18T13:22:30Z")
Hey Paul, > I realize the RFC does not permit unicode in URLs, but given that they > do occur in practice (browsers will just silently handle them), this > seems like something worth supporting. I think what you are looking for is this. > **[Internationalized Resource Identifier](https://en.wikipedia.org/wiki/Internationalized_resource_identifier)** > > The Internationalized Resource Identifier (IRI) is an internet protocol standard which builds on the Uniform Resource Identifier (URI) protocol by greatly expanding the set of permitted characters. It was defined by the Internet Engineering Task Force (IETF) in 2005 in RFC 3987. While URIs are limited to a subset of the US-ASCII character set (characters outside that set must be mapped to octets according to some unspecified character encoding, then percent-encoded), IRIs may additionall IRIs ext... > Thanks. > -Paul Best Christian ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/bros-escaping-of-non-printable-characters-behaves-unexpected/3494/6 "2022-05-06T15:42:28Z")