url: url.format() encodes all # in search

This commit fixes an error where only the first occurrence of `#` in
`search` parameter is URL encoded, and subsequent occurrences are not.

Also added a test for the case.

Fixes: https://github.com/nodejs/node/issues/8064
PR-URL: https://github.com/nodejs/node/pull/8072
Reviewed-By: James M Snell <jasnell@gmail.com>

lib/url.js

@@ -624,7 +624,7 @@ Url.prototype.format = function() {
     }
   }
 
-  search = search.replace('#', '%23');
+  search = search.replace(/#/g, '%23');
 
   if (hash && hash.charCodeAt(0) !== 35/*#*/) hash = '#' + hash;
   if (search && search.charCodeAt(0) !== 63/*?*/) search = '?' + search;

test/parallel/test-url.js

@@ -1176,6 +1176,19 @@ var formatTests = {
     pathname: '/fooA100%mBr',
   },
 
+  // multiple `#` in search
+  'http://example.com/?foo=bar%231%232%233&abc=%234%23%235#frag': {
+    href: 'http://example.com/?foo=bar%231%232%233&abc=%234%23%235#frag',
+    protocol: 'http:',
+    slashes: true,
+    host: 'example.com',
+    hostname: 'example.com',
+    hash: '#frag',
+    search: '?foo=bar#1#2#3&abc=#4##5',
+    query: {},
+    pathname: '/'
+  },
+
   // https://github.com/nodejs/node/issues/3361
   'file:///home/user': {
     href: 'file:///home/user',