src/robusta/utils/common.py (2)

51-53: Normalize whitespace to prevent accidental empty/invalid URLs.

Defensive trimming avoids surprises from " https://..." and makes the empty-check more robust.

-    if not url:
-        return ""
+    # Normalize leading/trailing whitespace
+    url = url.strip()
+    if not url:
+        return ""

---

48-50: Tighten the docstring to clarify behavior and idempotency.

Spell out which components are encoded and that existing %xx sequences are preserved.

-    """
-    Encode a URL so that it can be safely used in contexts where special characters must be escaped.
-    """
+    """
+    Encode a URL so it’s safe for sinks/renderers that require escaping.
+    - Encodes path, query, and fragment components.
+    - Preserves existing percent-escapes (does not double-encode).
+    - Returns "" for blank input.
+    """

src/robusta/core/reporting/base.py (1)

362-367: Skip appending links with empty/invalid URLs after encoding.

If link.url is blank or whitespace, encode_url returns "", and we’ll still append a broken link. Guard and log instead.

     def add_link(self, link: Link, suppress_warning: bool = False) -> None:
         if self.dirty and not suppress_warning:
             logging.warning("Updating a finding after it was added to the event is not allowed!")
-        link.url = encode_url(link.url)
-        self.links.append(link)
+        link.url = encode_url(link.url)
+        if not link.url:
+            logging.warning("Skipping link with empty URL (name=%s)", getattr(link, "name", ""))
+            return
+        self.links.append(link)

Note: since we mutate link.url, reusing the same Link instance elsewhere will see the encoded value. If that’s undesirable, consider copying.

I can scan the repo for add_link( callsites to check if any rely on mutating link.url afterward.

src/robusta/core/sinks/transformer.py (1)

126-128: Right fix; consider parity in HTML path.

Using encode_url here addresses Slack-style inputs like { in URLs. For consistency, consider applying encode_url in the HTML conversion path as well (__markdown_to_html, Lines 133–139) so both Markdown and HTML renderers handle unsafe characters identically.

-                encoded_url = encode_url(splits[0])
-                replacement = f"[{splits[1]}]({OPENING_ANGULAR}{encoded_url}{CLOSING_ANGULAR})"
+                encoded_url = encode_url(splits[0])
+                replacement = f"[{splits[1]}]({OPENING_ANGULAR}{encoded_url}{CLOSING_ANGULAR})"

Follow-up: mirror this in __markdown_to_html by wrapping link_parts[0] with encode_url(...).

I can open a small follow-up PR to apply the same helper in __markdown_to_html and add tests for both codepaths.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.