I take it back. Aaron has explained to me that this code is not actually responsible for decoding the "actualWebPath" variable so it can retrieve the file, it is simply ensuring that the webPath of the requested resource (webPath) matches with the attachment's stored webPath value (actualWebPath). Since these are fragments and could can contain characters that are not valid in a URI, it is not possible to use the URI.getPath() method to decode them. The only reasonable alternative method is the URLDecoder.decode(String) method. Since both values will be decoded using the same decoder (even it it isn't actually the correct one to use on non-data URLs, it works just fine here.