Bug with encoding the accountName parameter when calling UserPhoto.aspx from search results page

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

not applicable

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• browser version
• SPFx version
• Node.js version
• etc

Describe the bug / error

In the SharePoint Online org-wide search, results for users which are external members are missing their profile image (showing the default/generic silhouette image instead). This is because the template for a "People" search result is not encoding the # character in the account name to %23, which is causing the querystring of the fetched image Url (/_layouts/15/UserPhoto.aspx) to be truncated.

e.g. accountName=firstname.surname_domain.com#ext#@tenant.onmicrosoft.com is truncated to accountName=firstname.surname_domain.com (thus, the account is not found - and the default/generic profile image is returned instead).

The accountName querystring parameter needs encoding to (in this example) accountName=firstname.surname_domain.com%23ext%23@tenant.onmicrosoft.com, to make it Url-safe

Same issue when you click through to a People result (/_layouts/15/search.aspx/overview).

I tried reporting this bug in other ways - but not having any success.

Steps to reproduce

1. Use the org-wide SharePoint search bar to find a user who is an external member, with #ext# in their account name
2. Note that the search result is not showing a profile image for the user
3. Use the browser dev tools to "live" edit the Url to replace # with %23, and note that the profile image then appears.

Expected behavior

Where the profile image Url is being used in a SharePoint page, the accountName parameter should be encoded to make it Url-safe (e.g. in this instance, encoding # to %23).