[whatwg/url] Encode ' in username and password (#608)

```js
u = new URL("http://us'er:pa'ss@abc.com/");
console.log(u.username);
console.log(u.password);
```

In Chrome and Firefox, the `'` is escaped, in addition to Go. However, Safari, Node.js, and Ruby don't escape the `'`.

The case for `'` is weaker than `^` in pathname (#607), but would allow us to align with 2/3 implementations still. In addition, we currently escape `;` in userinfo, even though Go and Ruby don't escape it.

Making the change would be slightly tricky: adding `'` to [userinfo set](https://url.spec.whatwg.org/#userinfo-percent-encode-set) would also add it to the [component set](https://url.spec.whatwg.org/#component-percent-encode-set); however, the component set is effectively frozen due to its alignment with encodeURIComponent.

Fun fact, Chrome's equivalent of the [component set](https://source.chromium.org/chromium/chromium/src/+/main:url/url_canon_internal.h;l=46-48;drc=924ddf7fffcdc465838e48a40b08ed41bf480a5c) actually includes `'` despite what its documentation claims. But registerProtocolHandler uses the "[kQueryCharmap](https://source.chromium.org/chromium/chromium/src/+/main:net/base/escape.cc;l=107;drc=924ddf7fffcdc465838e48a40b08ed41bf480a5c)" defined in a separate part of the codebase, that happens to correspond exactly to encodeURIComponent.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/608