code: @Sensitive
      protected String decodeURL(@Sensitive String url) {
  
          url = url.replaceAll("%2C", ",");
          url = url.replaceAll("%3B", ";");
          url = url.replaceAll("%25", "%");
  
          return url;
      }
docs: Decode the specified URL String from percent encoding.
  
  Order of decoding:
  1. Decode "%2C" to commas.
  2. Decode "%3B" to semi-colons.
  3. Decode "%25" to percent signs.
  
  Technically decoding order is not that important, but its best to undo
  the encoding in the same order.
  
  @param url a non-null String
  @return decoded version of url