These functions could be called on untrusted input data, and since they do URI escaping/unescaping, they have non-trivial string handling code. Signed-off-by: Philip Withnall <pwithnall@gnome.org> See: #3827