url: `url.format()` encodes all `#` in `search`

This commit fixes an error where only the first occurrence of `#` in
`search` parameter is URL encoded, and subsequent occurrences are not.

Also added a test for the case.

Fixes: https://github.com/nodejs/node/issues/8064
PR-URL: https://github.com/nodejs/node/pull/8072
Reviewed-By: James M Snell <jasnell@gmail.com>

lib/url.js

@@ -413,7 +413,7 @@ Url.prototype.format = function() {
   pathname = pathname.replace(/[?#]/g, function(match) {
     return encodeURIComponent(match);
   });
-  search = search.replace('#', '%23');
+  search = search.replace(/#/g, '%23');
 
   return protocol + host + pathname + search + hash;
 };

test/parallel/test-url.js

@@ -1127,6 +1127,19 @@ var formatTests = {
     hash: '#frag',
     search: '?abc=the#1?&foo=bar',
     pathname: '/fooA100%mBr',
+  },
+
+  // multiple `#` in search
+  'http://example.com/?foo=bar%231%232%233&abc=%234%23%235#frag': {
+    href: 'http://example.com/?foo=bar%231%232%233&abc=%234%23%235#frag',
+    protocol: 'http:',
+    slashes: true,
+    host: 'example.com',
+    hostname: 'example.com',
+    hash: '#frag',
+    search: '?foo=bar#1#2#3&abc=#4##5',
+    query: {},
+    pathname: '/'
   }
 };
 for (const u in formatTests) {