Add allowed url characters to a safelist (#417)

* add allowed url characters to a safelist

* make werkzeug version the same as admin and api

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* go with a simpler approach

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: smcmurtry

.github/actions/waffles/requirements.txt

@@ -2,4 +2,4 @@ docopt==0.6.2
 Flask==2.3.3
 markupsafe==2.1.5
 setuptools==78.1.1 # required for distutils in Python 3.12
-git+https://github.com/cds-snc/notifier-utils.git@53.2.27#egg=notifications-utils
+git+https://github.com/cds-snc/notifier-utils.git@53.2.29#egg=notifications-utils

notifications_utils/formatters.py

@@ -496,7 +496,7 @@ def block_quote(self, text):
         ).format(text)
 
     def link(self, link, title, content):
-        safe_href = html.escape(sanitise_link_url(link), quote=True)
+        safe_href = sanitise_link_url(link).replace('"', "%22")
         title_attr = ' title="{}"'.format(html.escape(title, quote=True)) if title else ""
         return ('<a style="{}" href="{}"{}>{}</a>').format(
             LINK_STYLE,

poetry.lock

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "notifications-utils"
-version = "53.2.28"
+version = "53.2.29"
 description = "Shared python code for Notification - Provides logging utils etc."
 authors = ["Canadian Digital Service"]
 license = "MIT license"
@@ -39,7 +39,7 @@ PyYAML = "6.0.3"
 requests = "2.32.3"
 smartypants = "2.0.2"
 statsd = "3.3.0"
-werkzeug = "3.1.8"
+werkzeug = "3.1.6"
 
 [tool.poetry.group.test.dependencies]
 beautifulsoup4 = "^4.12.3"

pyproject.toml

@@ -742,7 +742,7 @@ def test_link_with_title(markdown_function, expected):
         # href with a stray double-quote must not break out of the attribute
         (
             '[hi](https://example.com"onmouseover="alert)',
-            "https://example.com"onmouseover="alert",
+            "https://example.com%22onmouseover=%22alert",
             "",
         ),
     ),
@@ -777,9 +777,18 @@ def test_email_link_blocks_unsafe_url_schemes(scheme_url):
     (
         "http://example.com",
         "https://example.com/path?q=1",
+        "https://example.com/path?a=1&b=2",  # & must not become &
         "mailto:hi@example.com",
         "tel:+15551234567",
         "example.com/relative",  # no scheme — passed through
+        "https://example.com/search?q=hello%20world",
+        "https://example.com/search?q=a+b",
+        "https://example.com/?q=one&two=three",
+        "https://example.com/page#section-1",
+        "https://example.com/café",
+        "https://example.com/a%2Fb",
+        "https://example.com/?next=%2Fadmin%3Fdebug%3D1",
+        "https://example.com/~user/path",
     ),
 )
 def test_email_link_allows_safe_url_schemes(safe_url):