url: decode url entities in auth section

Fixes #2736.

lib/url.js

@@ -135,19 +135,21 @@ function urlParse(url, parseQueryString, slashesDenoteHost) {
     // URLs are obnoxious.
     var atSign = rest.indexOf('@');
     if (atSign !== -1) {
+      var auth = rest.slice(0, atSign);
+
       // there *may be* an auth
       var hasAuth = true;
       for (var i = 0, l = nonAuthChars.length; i < l; i++) {
-        var index = rest.indexOf(nonAuthChars[i]);
-        if (index !== -1 && index < atSign) {
+        if (auth.indexOf(nonAuthChars[i]) !== -1) {
           // not a valid auth.  Something like http://foo.com/bar@baz/
           hasAuth = false;
           break;
         }
       }
+
       if (hasAuth) {
         // pluck off the auth portion.
-        out.auth = rest.substr(0, atSign);
+        out.auth = decodeURIComponent(auth);
         rest = rest.substr(atSign + 1);
       }
     }
@@ -329,11 +331,8 @@ function urlFormat(obj) {
 
   var auth = obj.auth || '';
   if (auth) {
-    auth = auth.split('@').join('%40');
-    for (var i = 0, l = nonAuthChars.length; i < l; i++) {
-      var nAC = nonAuthChars[i];
-      auth = auth.split(nAC).join(encodeURIComponent(nAC));
-    }
+    auth = encodeURIComponent(auth);
+    auth = auth.replace(/%3A/i, ':');
     auth += '@';
   }
 

test/simple/test-url.js

@@ -71,6 +71,26 @@ var parseTests = {
     'pathname': '/',
     'path': '/'
   },
+  'http://user@www.example.com/' : {
+    'href': 'http://user@www.example.com/',
+    'protocol': 'http:',
+    'slashes': true,
+    'auth': 'user',
+    'host': 'www.example.com',
+    'hostname': 'www.example.com',
+    'pathname': '/',
+    'path': '/'
+  },
+  'http://user%3Apw@www.example.com/' : {
+    'href': 'http://user:pw@www.example.com/',
+    'protocol': 'http:',
+    'slashes': true,
+    'auth': 'user:pw',
+    'host': 'www.example.com',
+    'hostname': 'www.example.com',
+    'pathname': '/',
+    'path': '/'
+  },
   'http://x.com/path?that\'s#all, folks' : {
     'href': 'http://x.com/path?that%27s#all,',
     'protocol': 'http:',
@@ -324,7 +344,7 @@ var parseTests = {
     'protocol' : 'http:',
     'slashes': true,
     'host' : '127.0.0.1:8080',
-    'auth' : 'atpass:foo%40bar',
+    'auth' : 'atpass:foo@bar',
     'hostname' : '127.0.0.1',
     'port' : '8080',
     'pathname': '/path',