Suricata

Is this update libhtp or suricata?

I think the least performance impacting way would be in the current libhtp decode routines. It would be best if we can do it w/o doing a separate pass over the data.

What is expected here ? ie what do you mean by "detect" ?
Should we trigger an http event ? Or should we double decode the URI if necessary ? (and keep raw uri as is already done)

I think the idea is/was that double decoding is possibly used as an evasion technique, so we want to be able to decode it and indeed match on the fact that its double decoded. So a http event indeed.