Disallowed characters in URI

As I said before. In my opinion the url should not be decoded before the checkDisallowedChars.

It is wrong.
Because the decoded data is processed in the framework and your app code.

URL encoding can encode any binary data.
Do you want to accept binary data as a URI path?
In almost all cases, it would be no.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper