Handle backslashes like Node.js and Chrome

[kara-ryli]

RFC 2396 section 2.4.3 puts backslashes (\) in the "unwise" list
of characters that aren't allowed in URIs. However, IE, Opera and Chrome
normalize backslashes to slashes (/), as noted in Chromium.

Since URI.js doesn't do this, it creates possible vulnerabilities. For
example:

var page = URI(window.location.href);
var redirect = URI(page.search(true).redirect_uri);
if (page.domain() === redirect.domain()) {
  window.location = redirect.href();
}

This logic will work fine, except when redirect has backslashes in the
host, e.g.

http://i.xss.com\www.example.org/foo

In this case, you'll get:

URI("http://www.example.org").domain();
// example.org
URI("http://i.xss.com\\www.example.org/foo").domain();
// example.org

...yet the browsers will redirect you to

http://i.xss.com/www.example.org/foo

which could be a phishing site.

The supplied change simply replaces all backslashes before the query/hash with slashes. This workaround is also in Node.

[rodneyrehm]

I wonder if escaping \ to %5C might be the better choice. I'm going with your suggestion for now, but might later switch to escape instead of replace.

[rodneyrehm]

I've made your fix also apply to the mutator functions and released v1.16.0

[kara-ryli]

Regarding \ -> %5C the WhatWG spec recommends throwing an error if you encounter invalid characters, but I prefer the above method since it's what the browsers do and doesn't require me to wrap my URL parsing code in a try/catch with untrusted input.