Function encode_target 

pub fn encode_target(uri: &str) -> String

Percent-encode the bytes that cannot appear literally in a URI reference.

A string carrying a raw CR, LF, space, or angle bracket is not a URI to be rejected — it is a URI that has not been encoded yet, and encoding it is what {RFC 3986} requires. That this also makes response-header injection impossible is a consequence rather than a separate mechanism: a CR becomes %0D and can no longer terminate the field, and a > becomes %3E and can no longer close the target early.

Already-encoded input passes through unchanged, because % is left alone. The delimiters a URI needs — ? # / : @ & = + and the other sub-delims — are all legal and preserved, so a query string or fragment survives intact.