[gr8man]

Description

Router::handle() decoded the URI only once, so a multiply-encoded URI could still contain %XX sequences and bypass checkDisallowedChars() when decoded again. The check now decodes the URI until it stops changing before validating it; routing keeps using the single-decoded path so URI filter matching is unchanged.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[gr8man]

The random test failure in this PR (Autoloader / FileLocatorCachedTest::testDeleteCache) is unrelated to the changes here.

The random test execution runs the components in parallel, and the Commands component (OptimizeTest, ClearCacheTest) deletes the shared writable/cache/FileLocatorCache file that the Autoloader component asserts on.

Fixed in #10647 by giving FileVarExportHandler the directory it stores its files in, so the tests use their own directory.

[michalsn]

Could you provide a concrete example showing which component decodes the routed value again? %253C becomes literal %3C after one decode, which the whitelist permits. Laravel and Symfony also decode route paths once. Recursive validation would reject previously accepted input, so I'd like to understand the scenario that makes this necessary.