url: url.format() encodes all # in search

This commit fixes an error where only the first occurrence of `#` in
`search` parameter is URL encoded, and subsequent occurrences are not.

Also added a test for the case.

Fixes: #8064
PR-URL: #8072
Reviewed-By: James M Snell <jasnell@gmail.com>

 Conflicts:
	test/parallel/test-url.js

lib/url.js

@@ -619,7 +619,7 @@ Url.prototype.format = function() {
     host = '';
   }
 
-  search = search.replace('#', '%23');
+  search = search.replace(/#/g, '%23');
 
   if (hash && hash.charCodeAt(0) !== 35/*#*/) hash = '#' + hash;
   if (search && search.charCodeAt(0) !== 63/*?*/) search = '?' + search;

test/parallel/test-url.js

@@ -1165,6 +1165,19 @@ var formatTests = {
     hash: '#frag',
     search: '?abc=the#1?&foo=bar',
     pathname: '/fooA100%mBr',
+  },
+
+  // multiple `#` in search
+  'http://example.com/?foo=bar%231%232%233&abc=%234%23%235#frag': {
+    href: 'http://example.com/?foo=bar%231%232%233&abc=%234%23%235#frag',
+    protocol: 'http:',
+    slashes: true,
+    host: 'example.com',
+    hostname: 'example.com',
+    hash: '#frag',
+    search: '?foo=bar#1#2#3&abc=#4##5',
+    query: {},
+    pathname: '/'
   }
 };
 for (const u in formatTests) {