web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java
public void setAllowUrlEncodedPercent(boolean allowUrlEncodedPercent) {
		if (allowUrlEncodedPercent) {
			this.encodedUrlBlacklist.remove(ENCODED_PERCENT);
			this.decodedUrlBlacklist.remove(PERCENT);
		} else {
			this.encodedUrlBlacklist.add(ENCODED_PERCENT);
			this.decodedUrlBlacklist.add(PERCENT);
		}
	}
public void setAllowUrlEncodedPercent(boolean allowUrlEncodedPercent) {
		if (allowUrlEncodedPercent) {
			this.encodedUrlBlacklist.remove(ENCODED_PERCENT);
			this.decodedUrlBlacklist.remove(PERCENT);
		} else {
			this.encodedUrlBlacklist.add(ENCODED_PERCENT);
			this.decodedUrlBlacklist.add(PERCENT);
		}
	}
<p>
Determines if a percent "%" that is URL encoded "%25" should be allowed in the path
or not. The default is not to allow this behavior because it is a frequent source
of security exploits.
</p>
<p>
For example, this can lead to exploits that involve double URL encoding that lead
to bypassing security constraints.
</p>

@param allowUrlEncodedPercent if a percent "%" that is URL encoded "%25" should be
allowed in the path or not. Default is false