In general, links are allowed. Having said this, if the link targets a webpage with a virus, or porn, or warez, or something else that Upwork considers "bad", then the job post should not have made it past the "check" that all jobs go through with a real human from Upwork.
Alas, some bad links in job posts do end up being made public.
If bad links are in a job post, then the job post can and should be reported.
Now, on to the nitty gritty for those wondering "how do I know a link is safe?".
Links that have been "hidden" are suspect - The location of the page the link will take you to has been hidden, and may appear like this: http://bit.ly/Wn2Xdz. That example goes to Wikipedia, but generally, legit Clients won't hide links.
ID'ing Links - Not sure what URL a link is pointing at / will take you to? - You have several options, based on your computer OS, browser, etc. I can give 2 examples via Firefox, and Windows 7. Hovering OVER a link displays it's target, in the lowest bottom left corner of Firefox. Or, you can right click a link (or button), then select "Copy Link", then "Paste" into a .txt file. Try that with the link in this post, if you are not familiar with these functions.
Does a link take you to a page that asks you for contact info? - This might be a field for your Skype ID, Email Address, or gawd forbid, your Social, Home Address, Cell #, etc. In any case, I would avoid adding any and all info to a page like that.
Links to "anon questionaires" - If you end up on a page that has a bunch of questions about the job, and a field for say, your Upwork profile URL, that's probably safe.