url: support LF, CR and TAB in pathToFileURL

Fixes: https://github.com/nodejs/node/issues/23696

PR-URL: https://github.com/nodejs/node/pull/23720
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

1 files changed, 20 insertions, 3 deletions

diff --git a/lib/internal/url.js b/lib/internal/url.js
index 440fc0315e..ae1adad8c1 100644
--- a/lib/internal/url.js
+++ b/lib/internal/url.js
@@ -1339,11 +1339,22 @@ function fileURLToPath(path) {
   return isWindows ? getPathFromURLWin32(path) : getPathFromURLPosix(path);
 }
 
-// We percent-encode % character when converting from file path to URL,
-// as this is the only character that won't be percent encoded by
-// default URL percent encoding when pathname is set.
+// The following characters are percent-encoded when converting from file path
+// to URL:
+// - %: The percent character is the only character not encoded by the
+//        `pathname` setter.
+// - \: Backslash is encoded on non-windows platforms since it's a valid
+//      character but the `pathname` setters replaces it by a forward slash.
+// - LF: The newline character is stripped out by the `pathname` setter.
+//       (See whatwg/url#419)
+// - CR: The carriage return character is also stripped out by the `pathname`
+//       setter.
+// - TAB: The tab character is also stripped out by the `pathname` setter.
 const percentRegEx = /%/g;
 const backslashRegEx = /\\/g;
+const newlineRegEx = /\n/g;
+const carriageReturnRegEx = /\r/g;
+const tabRegEx = /\t/g;
 function pathToFileURL(filepath) {
   let resolved = path.resolve(filepath);
   // path.resolve strips trailing slashes so we must add them back
@@ -1358,6 +1369,12 @@ function pathToFileURL(filepath) {
   // in posix, "/" is a valid character in paths
   if (!isWindows && resolved.includes('\\'))
     resolved = resolved.replace(backslashRegEx, '%5C');
+  if (resolved.includes('\n'))
+    resolved = resolved.replace(newlineRegEx, '%0A');
+  if (resolved.includes('\r'))
+    resolved = resolved.replace(carriageReturnRegEx, '%0D');
+  if (resolved.includes('\t'))
+    resolved = resolved.replace(tabRegEx, '%09');
   outURL.pathname = resolved;
   return outURL;
 }