Repository: mozilla/bleach

Issue:
bug: `linkify` with `parse_email=True` doesn't handle "%" a "?" in `addr-specs`
**Describe the bug**

bug: `linkify` with `parse_email=True` doesn't handle "%" and "?", which may occur in RFC822 addr-specs (see https://datatracker.ietf.org/doc/html/rfc2368#section-6)

 - Python Version: 3.10.4
 - Bleach Version: 5.0.0

**To Reproduce**

Steps to reproduce the behavior:

```python
>>> bleach.linkify("gorby%kremvax@example.com", parse_email=True)
'<a href="mailto:gorby%kremvax@example.com">gorby%kremvax@example.com</a>'
```

**Expected behavior**

I expected RFC822 special characters to be percent-encoded according to RFC2368:

```python
>>> bleach.linkify("gorby%kremvax@example.com", parse_email=True)
'<a href="mailto:gorby%25kremvax@example.com">gorby%kremvax@example.com</a>'
```

**Additional context**

Same issue exists with "?"; I didn't test other RFC822 special characters but suspect they are similarly left unquoted.

Comments:

Patch:
diff --git a/bleach/linkifier.py b/bleach/linkifier.py
index 68a4042..df56f3c 100644
--- a/bleach/linkifier.py
+++ b/bleach/linkifier.py
@@ -1,5 +1,7 @@
 import re
 
+from urllib.parse import quote
+
 from bleach import callbacks as linkify_callbacks
 from bleach import html5lib_shim
 
@@ -298,10 +300,15 @@ class LinkifyFilter(html5lib_shim.Filter):
                             {"type": "Characters", "data": text[end : match.start()]}
                         )
 
+                    # URL-encode the "local-part" according to RFC6068
+                    parts = match.group(0).split("@")
+                    parts[0] = quote(parts[0])
+                    address = "@".join(parts)
+
                     # Run attributes through the callbacks to see what we
                     # should do with this match
                     attrs = {
-                        (None, "href"): "mailto:%s" % match.group(0),
+                        (None, "href"): "mailto:%s" % address,
                         "_text": match.group(0),
                     }
                     attrs = self.apply_callbacks(attrs, True)


Test patch:
diff --git a/tests/test_linkify.py b/tests/test_linkify.py
index 69181ca..fbabf12 100644
--- a/tests/test_linkify.py
+++ b/tests/test_linkify.py
@@ -104,6 +104,17 @@ def test_mangle_text():
         ),
         # Incorrect email
         ('"\\\n"@opa.ru', True, '"\\\n"@opa.ru'),
+        # RFC6068 special characters
+        (
+            "gorby%kremvax@example.com",
+            True,
+            '<a href="mailto:gorby%25kremvax@example.com">gorby%kremvax@example.com</a>',
+        ),
+        (
+            "unlikely?address@example.com",
+            True,
+            '<a href="mailto:unlikely%3Faddress@example.com">unlikely?address@example.com</a>',
+        ),
     ],
 )
 def test_email_link(data, parse_email, expected):
@@ -115,15 +126,15 @@ def test_email_link(data, parse_email, expected):
     [
         (
             '"james"@example.com',
-            """<a href='mailto:"james"@example.com'>"james"@example.com</a>""",
+            """<a href="mailto:%22james%22@example.com">"james"@example.com</a>""",
         ),
         (
             '"j\'ames"@example.com',
-            """<a href="mailto:&quot;j'ames&quot;@example.com">"j'ames"@example.com</a>""",
+            """<a href="mailto:%22j%27ames%22@example.com">"j'ames"@example.com</a>""",
         ),
         (
             '"ja>mes"@example.com',
-            """<a href='mailto:"ja>mes"@example.com'>"ja&gt;mes"@example.com</a>""",
+            """<a href="mailto:%22ja%3Emes%22@example.com">"ja&gt;mes"@example.com</a>""",
         ),
     ],
 )