char *url_decode(char *str) {
    size_t size = strlen(str) + 1;

    char *buf = mallocz(size);
    return url_decode_r(buf, str, size);
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.