Upstreaming from https://phabricator.wikimedia.org/T370110
/var/log/apache2/phabricator_error.log in our installation listed entries like [rewrite:error] [pid 947281:tid 947294] [client redacted] AH10508: Unsafe URL with %3f URL rewritten without UnsafeAllow3F
This happens since https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/modules/mappers/mod_rewrite.c?r1=1918560&r2=1918561&pathrev=1918561&diff_format=h introduced due to https://www.cve.org/CVERecord?id=CVE-2024-38474