[whatwg/url] percent-encode ' in queries of URLs with special schemes (#348)

This is needed for compatibility, and it makes some injection attacks harder by preventing ' from being sent to the server.  

Chrome, Firefox, and Safari all have this behavior.  I haven't tested Edge or IE.  This can be verified as simply as this:
alert(new URL("http://host/pa'th?qu'ery#fra'gment"));
alert(new URL("asdf://host/pa'th?qu'ery#fra'gment"));


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/348