The length of sanitized URI is either the same, or less than original one, so we can use char[] to reduce overhead brought by StringBuilder.