Hostname Spoofing

urijs is vulnerable to hostname spoofing. The hostname can be spoofed by using a backslash \ character followed by an @ character, which could potentially allow an attacker to bypass authorization if the hostname is used in security decisions...