Can't add groups that start with #

[OEI-Cgray]

Jenkins and plugins versions report

Environment

Jenkins: 2.319.1
OS: Windows Server 2019 - 10.0
---
Office-365-Connector:4.15.2
ace-editor:1.1
active-directory:2.25
ant:1.13
antisamy-markup-formatter:2.6
apache-httpcomponents-client-4-api:4.5.13-1.0
authentication-tokens:1.4
azure-ad:189.v2da14dccdb43
azure-commons:1.1.3
azure-credentials:198.vf9c2fdfde55c
azure-keyvault:131.v867845ef6ae9
azure-sdk:70.v63f6a95999a7
bootstrap4-api:4.6.0-3
bootstrap5-api:5.1.3-4
bouncycastle-api:2.25
branch-api:2.7.0
build-timeout:1.20
build-user-vars-plugin:1.8
caffeine-api:2.9.2-29.v717aac953ff3
checks-api:1.7.2
cloudbees-disk-usage-simple:0.10
cloudbees-folder:6.17
command-launcher:1.6
conditional-buildstep:1.4.1
credentials:1055.v1346ba467ba1
credentials-binding:1.27
display-url-api:2.3.5
docker-commons:1.17
docker-workflow:1.26
durable-task:493.v195aefbb0ff2
echarts-api:5.2.2-2
email-ext:2.86
envinject:2.4.0
envinject-api:1.8
extended-read-permission:3.2
external-monitor-job:1.7
folder-properties:1.2.1
font-awesome-api:5.15.4-5
git-client:3.11.0
git-server:1.10
handlebars:3.0.8
http_request:1.12
jackson2-api:2.13.1-244.v773c36c5b330
javadoc:1.6
jaxb:2.3.0.1
jdk-tool:1.5
jquery-detached:1.2.1
jquery3-api:3.6.0-2
jsch:0.1.55.2
junit:1.53
ldap:2.7
lockable-resources:2.13
mailer:1.34
matrix-auth:3.0
matrix-project:1.19
maven-plugin:3.16
metrics:4.0.2.8
momentjs:1.1.1
msbuild:1.30
p4:1.11.6
pam-auth:1.6.1
parameterized-trigger:2.43
pipeline-build-step:2.15
pipeline-graph-analysis:188.v3a01e7973f2c
pipeline-input-step:427.va6441fa17010
pipeline-milestone-step:1.3.2
pipeline-model-api:1.9.3
pipeline-model-definition:1.9.3
pipeline-model-extensions:1.9.3
pipeline-rest-api:2.20
pipeline-stage-step:291.vf0a8a7aeeb50
pipeline-stage-tags-metadata:1.9.3
pipeline-stage-view:2.20
pipeline-utility-steps:2.11.0
plain-credentials:1.7
plugin-util-api:2.10.0
popper-api:1.16.1-2
popper2-api:2.11.0-1
powershell:1.7
prometheus:2.0.10
resource-disposer:0.17
role-strategy:3.2.0
run-condition:1.5
saml:2.0.9
schedule-build:178.v32999348869c
scm-api:2.6.5
script-security:1118.vba21ca2e3286
slack:2.49
snakeyaml-api:1.29.1
ssh-credentials:1.19
sshd:3.1.0
strict-crumb-issuer:2.1.0
structs:308.v852b473a2b8c
timestamper:1.15
token-macro:267.vcdaea6462991
trilead-api:1.0.13
variant:1.4
versioncolumn:2.2
windows-slaves:1.8
workflow-aggregator:2.6
workflow-api:1108.v57edf648f5d4
workflow-basic-steps:2.24
workflow-cps:2648.va9433432b33c
workflow-cps-global-lib:552.vd9cc05b8a2e1
workflow-durable-task-step:1112.vda00e6febcc1
workflow-job:1145.v7f2433caa07f
workflow-multibranch:696.v52535c46f4c9
workflow-scm-step:2.13
workflow-step-api:615.vb09dac339255
workflow-support:804.vba10a18a1476
ws-cleanup:0.40

What Operating System are you using (both controller, and any agents involved in the problem)?

Windows Server 2019 Core

Reproduction steps

Find group that starts with #.
Get 400 bad request error.

Expected Results

Find the groups.

Actual Results

HTTP 400 Bad Request

Anything else?

The message below comes from firefox, the search string was simply the pound character. The filter is cut-off where the pound character would be.

The GET request was:
GET https://builds.redacted.com//GraphProxy/v1.0/groups?$filter=(startswith(displayName,'#') or startswith(mailNickname,'#') or startswith(mail,'#'))&$top=10

scheme	https
host	builds.redacted.com
filename	//GraphProxy/v1.0/groups
$filter	(startswith(displayName,'
Address	10.42.1.150:443

Status

400

Bad Request

VersionHTTP/1.1

Transferred511 B (220 B size)

Referrer Policysame-origin

[OEI-Cgray]

Using %23 works.