DataURI uses the following implementation to decode the percent-encoded payload of a "data" URI:

```
...
String data = uri.substring(dataSeparator + 1);
Charset charset = Charset.defaultCharset();
...
URLDecoder.decode(data.replace("+", "%2B"), charset).getBytes(charset)
```

This approach only works if the charset that is passed into `URLDecoder.decode` and `String.getBytes` doesn't lose information when converting between `String` and `byte[]` representations, as might happen in a US-ASCII environment.

The bug should be fixed by not using `URLDecoder`, but instead simply decoding percent-encoded escape sequences as specified by RFC 3986, page 11.