Escape URI delimiters inside asset paths and query values

[OskarEichler]

Summary

Asset filenames containing ?, [ or ] and query values containing & are escaped as components, preserving existing plus, slash and percent handling.

Ordinary serialized URIs remain byte-identical; only problematic component characters change. Existing raw-space proposal #689 is separate. Initial Regexp.union approach was rejected after ~55% slowdown; single character classes measured within about 2% of original on 38/20/223-character paths (seven alternating batches, 20,000 calls each). This is a microbenchmark, not an application-speed claim.

Reproduction

With require "sprockets"; require "tmpdir":

u = Sprockets::URIUtils
path = "/tmp/entry?[v1].js"
uri = u.build_asset_uri(path, index_alias: "/tmp/a&b.js")
p u.parse_asset_uri(uri)
# ["/tmp/entry?[v1].js", {index_alias: "/tmp/a&b.js"}]
# Before: invalid URI, or truncated path/query for ? and & respectively.

Verification

• Isolated patch and release baseline: unchanged bundle exec rake test, 913 tests /4,109 assertions /zero failures/errors /four skips, Ruby 3.2.11 and 4.0.6. 504 focused external checks for this patch on each Ruby.
• Eight follow-ups combined with existing Use Ruby 3 keyword argument handling for find_asset! #792: same suite plus 1,540 focused checks per Ruby. Combined isolated test task also passes. Full RuboCop passes all 133 files; Ruby syntax and diff whitespace checks pass.
• Gem build preserves 84 file paths, version 4.4.1, Ruby >=2.5 and dependency metadata. Consumer based on installed release/current main 49d9f20c00ac7d9a7ee57db058961edcccd86699, without unrelated upgrades.
• Existing asset-clean test is timing-sensitive: touching its fixture within the current timestamp second reproduced the same line-80 assertion failure on baseline and an independent cache patch (2/4 each). Full successful runs above are actual runs; no test code was changed. Normal skips cover legacy Ruby, Windows and two Sass cases; non-terminal stdin adds the Unix-device skip.

Compatibility and limitations

Breaking changes: no intentional change to valid supported behavior; the incorrect behavior above changes. No new dependencies or version upgrades. Older Ruby/Linux/JRuby checks are left to upstream CI, not claimed locally. No tests added/edited under the consumer repository's no-test-edit policy; focused evidence was run externally. Prepared with AI assistance. This is a focused correction, not an exhaustive Sprockets review.