diff -r a5aa94800b59 -r ff14b97bdf14 src/server/test/uri.c
--- a/src/server/test/uri.c	Sat Feb 21 21:52:08 2026 +0100
+++ b/src/server/test/uri.c	Sun Feb 22 09:24:41 2026 +0100
@@ -190,3 +190,43 @@
         CX_TEST_ASSERT(!util_parse_uri("http://localhost:9999999", &uri));
     }
 }
+
+CX_TEST(test_util_uri_escape_s) {
+    CX_TEST_DO {
+        char out[64];
+        memset(out, 'x', 64);
+        CX_TEST_ASSERT(util_uri_escape_s(out, 64, "") == 0);
+        CX_TEST_ASSERT(out[0] == 0);
+        
+        CX_TEST_ASSERT(util_uri_escape_s(out, 64, "/") == 1);
+        CX_TEST_ASSERT(out[0] == '/' && out[1] == 0);
+        
+        CX_TEST_ASSERT(util_uri_escape_s(out, 64, "/copy/path") == 10);
+        CX_TEST_ASSERT(out[10] == 0);
+        CX_TEST_ASSERT(!strcmp(out, "/copy/path"));
+        
+        CX_TEST_ASSERT(util_uri_escape_s(out, 64, "/wspace /") == 11);
+        CX_TEST_ASSERT(out[11] == 0);
+        CX_TEST_ASSERT(!strcmp(out, "/wspace%20/"));
+        
+        CX_TEST_ASSERT(util_uri_escape_s(out, 64, "<>%&*") == 15);
+        CX_TEST_ASSERT(out[15] == 0);
+        CX_TEST_ASSERT(!strcasecmp(out, "%3c%3e%25%26%2a"));
+    }
+}
+
+CX_TEST(test_util_uri_escape_s_error) {
+    CX_TEST_DO {
+        char out[64];
+        memset(out, 'x', 64);
+        CX_TEST_ASSERT(util_uri_escape_s(out, 0, "X") == 0);
+        CX_TEST_ASSERT(util_uri_escape_s(out, 1, "X") == 0);
+        CX_TEST_ASSERT(util_uri_escape_s(out, 2, "/*") == 0);
+        CX_TEST_ASSERT(util_uri_escape_s(out, 3, "/*") == 0);
+        CX_TEST_ASSERT(util_uri_escape_s(out, 4, "/*") == 0);
+        CX_TEST_ASSERT(util_uri_escape_s(out, 12, "<>%&*") == 0);
+        CX_TEST_ASSERT(util_uri_escape_s(out, 13, "<>%&*") == 0);
+        CX_TEST_ASSERT(util_uri_escape_s(out, 14, "<>%&*") == 0);
+        
+    }
+}