Urlize incorrectly handles punctuation in email addresses

[Mike Edmunds]

Several punctuation characters (%, &, +, !, etc.) can—and sometimes do—appear in the local part of an email address (before the @). The urlize template filter doesn't correctly encode them, which can result in broken mailto links.

Example (Django 5.1.4):

from django.template.defaultfilters import urlize
urlize("it%dept@example.org")
#   '<a href="mailto:it%dept@example.org">it%dept@example.org</a>'
# Expected:
#   '<a href="mailto:it%25dept@example.org">it%dept@example.org</a>'

Clicking the resulting mailto link might work as expected, or do nothing, or could launch a mail composer with a missing or incorrect email address, depending on the specific address, browser and email app. Sequences that could also be percent-encoded characters (like "%de" in the example) are especially prone to unpredictable results.

The mailto URI spec ​RFC 6068 requires percent encoding most punctuation in this situation (section 2, item 1; also see section 5, Encoding).

Proposed fix: apply urllib.parse.quote() to local where the ​mailto link is constructed in django.utils.html.Urlizer. (Although not strictly necessary, it wouldn't hurt to also quote domain there.)

[Sarah Boyce <42296566+sarahboyce@…>]

In 322e49b:

Fixed #36012 -- Made mailto punctuation percent-encoded in Urlizer.

Urlizer was not properly encoding email addresses containing punctuation
in generated mailto links. Per RFC 6068, fixed by percent encoding
(urllib.parse.quote) the local and domain address parts.