Custom Link Model - semicolon (;) is sanitized during rendering

[o4sis]

NetBox version

v3.51

Python version

3.8

Steps to Reproduce

1. Customization -> Custom Links -> Entry -> Link URL
2. ; changed to %03B when following link.

Expected Behavior

Render ';' instead of %3B.

Observed Behavior

; is changed to %3B.

Sanitization on the custom link rendering added in 89fa546 prevents '';" in URL. Adding ';' into allowed list resolves issue.

# Sanitize link  
-        link = urllib.parse.quote_plus(link, safe='/:?&=%+[]@#')
+        link = urllib.parse.quote_plus(link, safe='/:?&=%+[]@#;')

[jsenecal]

As per rfc1738 and rfc3986;

The semicolon ";" is reserved and may not appear without quoting [...]

[o4sis]

@jsenecal - Please revisit the RFCs and reopen issue. The semicolon ';' is reserved and in the same class as a '?'.

[jsenecal]

@jsenecal - Please revisit the RFCs and reopen issue. The semicolon ';' is reserved and in the same class as a '?'.

Can you please link to the RFC and provide sections where you have information corroborating your point ?

[o4sis]

https://www.ietf.org/rfc/rfc1738.txt
RFC 1738 Uniform Resource Locators (URL) December 1994

Reserved:

Many URL schemes reserve certain characters for a special meaning:
their appearance in the scheme-specific part of the URL has a
designated semantics. If the character corresponding to an octet is
reserved in a scheme, the octet must be encoded. The characters ";",
"/", "?", ":", "@", "=" and "&" are the characters which may be
reserved for special meaning within a scheme. No other characters may
be reserved within a scheme.

Berners-Lee, Masinter & McCahill [Page 8]

RFC 1738 Uniform Resource Locators (URL) December 1994

3.3. HTTP

The HTTP URL scheme is used to designate Internet resources
accessible using HTTP (HyperText Transfer Protocol).

The HTTP protocol is specified elsewhere. This specification only
describes the syntax of HTTP URLs.

An HTTP URL takes the form:

  http://<host>:<port>/<path>?<searchpart>

where and are as described in Section 3.1. If :
is omitted, the port defaults to 80. No user name or password is
allowed. is an HTTP selector, and is a query
string. The is optional, as is the and its
preceding "?". If neither nor is present, the "/"
may also be omitted.

Within the and components, "/", ";", "?" are
reserved. The "/" character may be used within HTTP to designate a
hierarchical structure.

Berners-Lee, Masinter & McCahill [Page 19]

RFC 1738 Uniform Resource Locators (URL) December 1994

alpha = lowalpha | hialpha
digit = "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" |
"8" | "9"
safe = "$" | "-" | "_" | "." | "+"
extra = "!" | "*" | "'" | "(" | ")" | ","
national = "{" | "}" | "|" | "" | "^" | "~" | "[" | "]" | "`"
punctuation = "<" | ">" | "#" | "%" | <">

reserved = ";" | "/" | "?" | ":" | "@" | "&" | "="
hex = digit | "A" | "B" | "C" | "D" | "E" | "F" |
"a" | "b" | "c" | "d" | "e" | "f"
escape = "%" hex hex

unreserved = alpha | digit | safe | extra
uchar = unreserved | escape
xchar = unreserved | reserved | escape
digits = 1*digit

https://datatracker.ietf.org/doc/html/rfc3986#section-2.2
2.2. Reserved Characters

URIs include components and subcomponents that are delimited by
characters in the "reserved" set. These characters are called
"reserved" because they may (or may not) be defined as delimiters by
the generic syntax, by each scheme-specific syntax, or by the
implementation-specific syntax of a URI's dereferencing algorithm.
If data for a URI component would conflict with a reserved
character's purpose as a delimiter, then the conflicting data must be
percent-encoded before the URI is formed.

  reserved    = gen-delims / sub-delims

  gen-delims  = ":" / "/" / "?" / "#" / "[" / "]" / "@"

  sub-delims  = "!" / "$" / "&" / "'" / "(" / ")"
              / "*" / "+" / "," / ";" / "="