Repository: expressjs/express

Issue:
Response location broken for unicode domains in latest release
[This commit](https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94) broke parsing of valid unicode host names. Now it's only working with English domains. 

Plus such change shouldn't be done in a patch version, even minor is not valid here, because it's a breaking change. 

<!-- The process for bug fixing is:

- We will first assess if the behavior is different from what should occur
- Confirm the bug is reproducible
- Discuss how to best fix the bug
- Work towards a fix
-->

Discussion:
@wesleytodd: Hey @alexhanga, we were concerned about it but could not come up with a clear reproduction. You closed this, so did you find it was not actually broken? If you could provide a reproduction we would love it.@bjohansebas: It should have been fixed with #5569 

Solution patch:
diff --git a/History.md b/History.md
index ac2e7cf7..1aefd4b9 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: encodeurl@~2.0.0
+    - Removes encoding of `\`, `|`, and `^` to align better with URL spec
+
 4.19.2 / 2024-03-25
 ==========
 
diff --git a/lib/response.js b/lib/response.js
index dd7b3c82..29845a7d 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -55,7 +55,6 @@ module.exports = res
  */
 
 var charsetRegExp = /;\s*charset\s*=/;
-var schemaAndHostRegExp = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\/[^\\\/\?]+/;
 
 /**
  * Set status `code`.
@@ -914,14 +913,7 @@ res.location = function location(url) {
     loc = String(url);
   }
 
-  var m = schemaAndHostRegExp.exec(loc);
-  var pos = m ? m[0].length + 1 : 0;
-
-  // Only encode after host to avoid invalid encoding which can introduce
-  // vulnerabilities (e.g. `\\` to `%5C`).
-  loc = loc.slice(0, pos) + encodeUrl(loc.slice(pos));
-
-  return this.set('Location', loc);
+  return this.set('Location', encodeUrl(loc));
 };
 
 /**
diff --git a/package.json b/package.json
index f299d882..88e4206f 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "2.0.0",
-    "encodeurl": "~1.0.2",
+    "encodeurl": "~2.0.0",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
     "finalhandler": "1.2.0",



Test patch:
diff --git a/test/res.location.js b/test/res.location.js
index 141ee901..2e880026 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -293,23 +293,12 @@ describe('res', function(){
       );
     });
 
-    it('should percent encode backslashes in the path', function (done) {
+    it('should keep backslashes in the path', function (done) {
       var app = createRedirectServerForDomain('google.com');
       testRequestedRedirect(
         app,
         'https://google.com/foo\\bar\\baz',
-        'https://google.com/foo%5Cbar%5Cbaz',
-        'google.com',
-        done
-      );
-    });
-
-    it('should encode backslashes in the path after the first backslash that triggered path parsing', function (done) {
-      var app = createRedirectServerForDomain('google.com');
-      testRequestedRedirect(
-        app,
-        'https://google.com\\@app\\l\\e.com',
-        'https://google.com\\@app%5Cl%5Ce.com',
+        'https://google.com/foo\\bar\\baz',
         'google.com',
         done
       );
@@ -364,7 +353,7 @@ describe('res', function(){
       testRequestedRedirect(
         app,
         'file:///etc\\passwd',
-        'file:///etc%5Cpasswd',
+        'file:///etc\\passwd',
         '',
         done
       );