Encode emails properly before sending to /confirm-email (#12211)

* Refactor test a bit

* Account for URL encoding when redirecting to /confirm-email

* Fix failing spec

* Use correct method to encode + and @

* Fix test

* Don't encode things I don't need to (thanks Nick)

app/controllers/registrations_controller.rb

@@ -29,7 +29,7 @@ class RegistrationsController < Devise::RegistrationsController
       yield resource if block_given?
       if resource.persisted?
         update_first_user_permissions(resource)
-        redirect_to "/confirm-email?email=#{resource.email}"
+        redirect_to "/confirm-email?email=#{CGI.escape(resource.email)}"
       else
         render action: "by_email"
       end

cypress/integration/loginFlows/initialAdminLogin.spec.js

@@ -51,7 +51,9 @@ describe('Initial admin signup', () => {
       // The initial administrator user was create and is redirected to the confirm email screen.
       cy.url().should(
         'eq',
-        Cypress.config().baseUrl + '/confirm-email?email=' + admin.email,
+        Cypress.config().baseUrl +
+          '/confirm-email?email=' +
+          encodeURIComponent(admin.email),
       );
 
       cy.findByTestId('resend-confirmation-form').as('confirmationForm');

spec/system/authentication/user_logs_in_with_email_spec.rb

@@ -13,25 +13,33 @@ RSpec.describe "Authenticating with Email" do
     let(:user) { build(:user, saw_onboarding: false) }
 
     context "when using valid credentials" do
-      it "creates a new user", js: true do
-        expect do
-          visit sign_up_path(state: "new-user")
-          click_link(sign_up_link, match: :first)
-
-          fill_in_user(user)
-          click_button("Sign up", match: :first)
-        end.to change(User, :count).by(1)
-      end
-
-      it "logs in and redirects to email confirmation" do
+      def sign_up_user
         visit sign_up_path(state: "new-user")
         click_link(sign_up_link, match: :first)
 
         fill_in_user(user)
         click_button("Sign up", match: :first)
+      end
+
+      it "creates a new user", js: true do
+        expect do
+          sign_up_user
+        end.to change(User, :count).by(1)
+      end
+
+      it "logs in and redirects to email confirmation" do
+        sign_up_user
 
         expect(page).to have_current_path("/confirm-email", ignore_query: true)
       end
+
+      it "displays the properly decoded email" do
+        decoded_email = user.email.sub("@", "+something@")
+        user.email = decoded_email
+        sign_up_user
+
+        expect(page).to have_text(decoded_email)
+      end
     end
 
     context "when trying to register with an already existing email" do