visionmedia/express — pull request #1425 by gmethvin (2012-11-21 07:24:59+00:00)
Title: Escape URLs in text/plain res.redirect response

Escape the URL printed by res.redirect using URL encoding. This
prevents some browsers (primarily old versions of IE) from attempting
to sniff the Content-Type and evaluate it as HTML, which causes a
cross-site scripting vulnerability.