urldecode: add validation for URL encoding

### main/utils/urldecode.c
@@ -23,51 +23,99 @@ static char map_char(char c)
     return c;
 }
 
-// Simple urldecode function - any triple that looks like "%,hex,hex" is replaced by the character
-// specified, a '+' is replaced by a space, and anything else is copied verbatim.
-// The output string is always nul-terminated (although the input need not be).
-bool urldecode(const char* src, const size_t src_len, char* dest, const size_t dest_len)
+// Core implementation of URL decoding.
+// Destination buffer, 'dest' is allowed to be NULL for "dry run" processing (source validation).
+// Optional 'check_fn', if not NULL, is called for each decoded character for additional validation.
+static bool try_urldecode(
+    const char* src, const size_t src_len, char* dest, const size_t dest_len, int (*check_fn)(int))
 {
-    JADE_ASSERT(src);
-    JADE_ASSERT(src_len);
-    JADE_ASSERT(dest);
-    JADE_ASSERT(dest_len);
+    // We don't use assertions to give more flexibility for using this function to validate encoded
+    // string with uncertain arguments (like validating optional parameters that are absent atm).
+    if (!src || !src_len || !dest_len) {
+        return false;
+    }
 
     const char* src_end = src + src_len;
-    const char* dest_end = dest + dest_len;
+    char* dest_start = dest;
+    size_t decoded_len = 0;
 
-    // Handle both terminated and length-specified string data
-    while (src < src_end && *src) {
-        if (dest == dest_end - 1) {
-            // Destination insufficient - need last location for nul-terminator.
-            // Truncate (terminate) here and return false.
-            *dest = '\0';
+    // Handle both nul-terminated and length-specified string data.
+    // Nul-terminated string is accepted only if it has no nonzero characters after the terminator.
+    while (src < src_end) {
+        if (*src == '\0') {
+            // Verify that a nul-terminated string is nul-padded
+            while (src < src_end) {
+                if (*src++ != '\0') {
+                    return false;
+                }
+            }
+            break; // terminate processing of input string
+        }
+
+        if (decoded_len + 1 == dest_len) {
+            // Destination insufficient - need last location for nul-terminator
             return false;
         }
 
-        if ((*src == '%') && (src_end - src > 2) && isxdigit((unsigned char)src[1])
-            && isxdigit((unsigned char)src[2])) {
-            // Encoded hex character
-            *dest++ = (16 * map_char(src[1])) + map_char(src[2]);
+        int decoded;
+        if (*src == '%') {
+            // Ensure we have at least 2 more characters in the input string and both are hex digits
+            if ((src_end - src <= 2) || !isxdigit((unsigned char)src[1]) || !isxdigit((unsigned char)src[2])) {
+                return false;
+            }
+
+            // Fetch 3 input characters and hex decode them into a single output character
+            decoded = (16 * map_char(src[1])) + map_char(src[2]);
             src += 3;
         } else if (*src == '+') {
             // Encoded <space>
-            *dest++ = ' ';
+            decoded = ' ';
             ++src;
         } else {
-            // Copy across
-            *dest++ = *src++;
+            // Assign "as is" (avoiding signed promotion)
+            decoded = (unsigned char)*src++;
+        }
+
+        // Ensure the character falls in the allowed range: <space>...~
+        if (decoded < 0x20 || decoded > 0x7e) {
+            // Reject embedded nul, control characters, non-ASCII bytes and DEL
+            return false;
         }
+
+        // Use callback function for filtering decoded character if given
+        if (check_fn && !check_fn(decoded)) {
+            return false; // rejected by caller-provided check function: fail
+        }
+
+        // Copy decoded character into output buffer if we aren't in the "dry run" mode
+        if (dest) {
+            *dest++ = decoded;
+        }
+        ++decoded_len;
     }
 
-    JADE_ASSERT(dest < dest_end);
-    *dest = '\0';
+    // Sanity check: ensure all input characters are processed
+    JADE_ASSERT(src == src_end);
+    // Sanity check: ensure we didn't overrun the output buffer
+    JADE_ASSERT(decoded_len < dest_len);
+    // Nul-terminate the output string if we aren't in the "dry run" mode
+    if (dest) {
+        // Sanity check: destination pointer is consistent with decoded counter
+        JADE_ASSERT(dest == dest_start + decoded_len);
+        *dest = '\0';
+    }
     return true;
 }
 
-// Simple urlencode function - special chars are replaced by %XX, space is replaced by '+',
-// and anything else is copied verbatim.
-// The output string is always nul-terminated (although the input need not be).
+bool urldecode(const char* src, const size_t src_len, char* dest, const size_t dest_len)
+{
+    JADE_ASSERT(src);
+    JADE_ASSERT(src_len);
+    JADE_ASSERT(dest);
+    JADE_ASSERT(dest_len);
+    return try_urldecode(src, src_len, dest, dest_len, NULL);
+}
+
 bool urlencode(const char* src, const size_t src_len, char* dest, const size_t dest_len)
 {
     JADE_ASSERT(src);
@@ -112,4 +160,11 @@ bool urlencode(const char* src, const size_t src_len, char* dest, const size_t d
     *dest = '\0';
     return true;
 }
+
+bool is_valid_urlencoding(const char* src, const size_t src_len, const size_t max_len, int (*check_fn)(int))
+{
+    JADE_ASSERT(max_len);
+    return try_urldecode(src, src_len, NULL, max_len, check_fn);
+}
+
 #endif // AMALGAMATED_BUILD

### main/utils/urldecode.h
@@ -6,7 +6,25 @@
 
 #include "../jade_assert.h"
 
+// Simple urldecode function - any triple that looks like "%XX" is replaced by the character
+// specified, a '+' is replaced by a space, and any printable characters are copied verbatim.
+// Both nul-terminated and length-specified input strings are supported but in latter case they must
+// be nul-padded.
+// The function returns true in case of success and false if there is an error in buffer sizes or
+// invalid encoding, including: embedded nul, or hex encoded characters outside 0x20-0x7f range.
+// In case of success the output string is always nul-terminated (although the input need not be).
 WARN_UNUSED_RESULT bool urldecode(const char* src, size_t src_len, char* dest, size_t dest_len);
+
+// Simple urlencode function - special chars are replaced by %XX, space is replaced by '+',
+// and anything else is copied verbatim.
+// The output string is always nul-terminated (although the input need not be).
 WARN_UNUSED_RESULT bool urlencode(const char* src, size_t src_len, char* dest, size_t dest_len);
 
+// Simple validation function for URL encoding, designed to operate in the same way as urldecode()
+// with an optional capability to filter decoded characters with a user-provided callback
+// function (can be NULL). The argument 'max_len' is used to limit the number of characters checked.
+// Both nul-terminated and length-specified input strings are supported but in latter case they must
+// be nul-padded.
+WARN_UNUSED_RESULT bool is_valid_urlencoding(const char* src, size_t src_len, size_t max_len, int (*check_fn)(int));
+
 #endif /* UTILS_URLDECODE_H_ */