Potentially incorrect behaviour processing URL query parameters

When an error is raised while processing query parameters the offending query parameter is dropped from the response

user=> (require '[ring.middleware.params :as p])
nil

user=> (p/assoc-query-params {:query-string "agencyids=MY_AGENCY&ids=ID_1,ID_2"} "UTF-8")
{:query-string "agencyids=MY_AGENCY&ids=ID_1,ID_2", :query-params {"agencyids" "MY_AGENCY", "ids" "ID_1,ID_2"}, :params {"agencyids" "MY_AGENCY", "ids" "ID_1,ID_2"}}

user=> (p/assoc-query-params {:query-string "agencyids=MY_AGENCY&ids=%3c%%3d77%2a77%%3e"} "UTF-8")
{:query-string "agencyids=MY_AGENCY&ids=%3c%%3d77%2a77%%3e", :query-params {"agencyids" "MY_AGENCY"}, :params {"agencyids" "MY_AGENCY"}}

In the last line the ids parameter is dropped as it contains illegal characters %3c%%3d77%2a77%%3e and cannot be decoded by java.net.URLDecoder/decode.

The downstream effect of this is that the query proceeds and ultimately responds with with a 200 OK while I would expect that you would want a 400 Bad Request response in this case. I have not been able to find an authoritative source on the correct response and I am interested to hear any opinions on this?

Start at ring.middleware.params/assoc-query-params and reproduce the two examples in a Clojure REPL. Trace how java.net.URLDecoder/decode errors are handled and review any nearby tests or middleware behavior. Done means the project has an agreed response for malformed query parameters and coverage for the reported input.