fix: adjust the order of t:urlDecodeUni and t:utf8toUnicode in 941160 PL1

[syinwu]

Adjusting the order of t:urlDecodeUni and t:utf8toUnicode transformations in rule 941160 to prevent FPs.

Fixes #3449.

[azurit]

Hi @Bxlxx. Thank for this PR. Can you, please, correctly set subject and description?

[azurit]

changelog comment:

feat: Adjusting the order of transformations in rule 941160 (bxlxx)

[dune73]

This is a change that needs to be discussed with regards to other rules as well. Let's hold back until we have discussed this.

[dune73]

Adding this to the agenda for meeting next Monday.

[fzipi]

BTW, no decision was taken in the March meeting. No one volunteered to take a more holistic look on the order of transformation yet.

[fzipi]

@dune73 From what I see in the original report, wouldn't this be the expected sequence for transformations? If this is fixing something, why don't we merge this one first and then create a new issue to track doing this for the rest?

[dune73]

Here is my interpretation of what is happening:

Old: utf8toUnicode,t:urlDecodeUni

/index.html´%2F%2E%2E%2F -> /index.html%u2019%2F%2E%2E%2F -> /index.html´/../

New: t:urlDecodeUni,t:utf8toUnicode

/index.html´%2F%2E%2E%2F -> /index.html´/../ -> /index.html%u2019/../

If this interpretation is correct, then I do not see the PR as the desired behavior.