write out %25 in hrefs where not part of a percent-encode sequence.

src/html.rs

@@ -1699,8 +1699,8 @@ pub fn escape(output: &mut dyn Write, buffer: &str) -> fmt::Result {
 /// * U+0027 APOSTROPHE ' is rendered as '
 /// * Alphanumeric and a range of non-URL safe characters.
 ///
-/// The inclusion of characters like "%" in those which are not escaped is
-/// explained somewhat here:
+/// Note that we leave "%" alone if it is followed by two hexdigits.
+/// See:
 ///
 /// <https://github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/src/houdini_href_e.c#L7-L31>
 ///
@@ -1721,7 +1721,7 @@ pub fn escape(output: &mut dyn Write, buffer: &str) -> fmt::Result {
 /// or `https` are permitted.
 pub fn escape_href(output: &mut dyn Write, buffer: &str, relaxed_ipv6: bool) -> fmt::Result {
     const HREF_SAFE: [bool; 256] = character_set!(
-        b"-_.+!*(),%#@?=;:/,+$~",
+        b"-_.+!*(),#@?=;:/,+$~",
         b"abcdefghijklmnopqrstuvwxyz",
         b"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
     );
@@ -1761,6 +1761,16 @@ pub fn escape_href(output: &mut dyn Write, buffer: &str, relaxed_ipv6: bool) ->
             b'\'' => {
                 output.write_str("&#x27;")?;
             }
+            b'%' => {
+                if bytes.get(i + 1).map_or(false, |b| b.is_ascii_hexdigit())
+                    && bytes.get(i + 2).map_or(false, |b| b.is_ascii_hexdigit())
+                {
+                    output.write_str(&buffer[i..=i + 2])?;
+                    i += 2;
+                } else {
+                    output.write_str("%25")?;
+                }
+            }
             0 => {
                 // U+FFFD REPLACEMENT CHARACTER
                 output.write_str("%EF%BF%BD")?;

src/tests/escape.rs

@@ -39,8 +39,9 @@ fn escape_inline_baseline() {
 /// [link destination]: https://spec.commonmark.org/0.31.2/#link-destination
 #[test]
 fn escape_link_target() {
-    let url = "rabbits) <cup\rcakes\n> [hyacinth](";
-    let escaped = r#"<rabbits) \<cup%0Dcakes%0A\> [hyacinth](>"#;
+    let url = "rabbits) <cup\rcakes\n> [%7Bhya%cinth%7d](";
+    let escaped = r#"<rabbits) \<cup%0Dcakes%0A\> [%7Bhya%cinth%7d](>"#;
+    let decoded = "rabbits) <cup\rcakes\n> [{hya%cinth}](";
 
     assert_eq!(escaped, escape_link_destination(url));
 
@@ -55,9 +56,12 @@ fn escape_link_target() {
         .expect("html should be one anchor in a paragraph")
         .to_string();
 
-    assert_eq!("rabbits)%20%3Ccup%0Dcakes%0A%3E%20%5Bhyacinth%5D(", html);
     assert_eq!(
-        url,
+        "rabbits)%20%3Ccup%0Dcakes%0A%3E%20%5B%7Bhya%25cinth%7d%5D(",
+        html
+    );
+    assert_eq!(
+        decoded,
         percent_encoding_rfc3986::percent_decode_str(&html)
             .unwrap()
             .decode_utf8()