Language: Java
Label: vulnerable
CWE: NVD-CWE-noinfo \u2014 

Code:
    void shouldReserveQuestionMark() {
        // '%3F' must not be decoded into '?'.
        assertAccepted(forServer("/abc%3F.json?a=%3F"), "/abc%3F.json", "a=%3F");
        assertAccepted(forClient("/abc%3F.json?a=%3F"), "/abc%3F.json", "a=%3F");
    }