I have tried a few different ways of trying to make this work but so far no luck.
The problem is that # is not valid within the userinfo, so all approaches to parsing just fail.

The current behavior will just fail this request which is really the correct behavior.  The buildpack url should be a valid url.  The onus should be on the user to make it right within reason.  The escaping makes perfect sense to protect us but we shouldn't confuse the two goals.