Escape reserved path characters in the remote images post-transform (#12253)

Co-authored-by: Adam Turner <[email protected]>

Author: jayaddison

sphinx/transforms/post_transforms/images.py

@@ -25,6 +25,10 @@
 
 MAX_FILENAME_LEN = 32
 CRITICAL_PATH_CHAR_RE = re.compile('[:;<>|*" ]')
+# Replace reserved Windows or Unix path characters with '/'.
+_URI_TO_PATH = {
+    ord(k): '/' for k in ('"', '&', '*', '/', ':', '<', '>', '?', '\\', '|')
+}
 
 
 class BaseImageConverter(SphinxTransform):
@@ -64,8 +68,7 @@ def handle(self, node: nodes.image) -> None:
                 basename = sha1(filename.encode(), usedforsecurity=False).hexdigest() + ext
             basename = CRITICAL_PATH_CHAR_RE.sub("_", basename)
 
-            dirname = node['uri'].replace('://', '/').translate({ord("?"): "/",
-                                                                 ord("&"): "/"})
+            dirname = node['uri'].replace('://', '/').translate(_URI_TO_PATH)
             if len(dirname) > MAX_FILENAME_LEN:
                 dirname = sha1(dirname.encode(), usedforsecurity=False).hexdigest()
             ensuredir(os.path.join(self.imagedir, dirname))