Koa redirect can lead to XSS

This issue is related to #363. Koa redirect can lead to a XSS if a JavaScript URL is passed.

Details:

1. Koa prints the redirected URL in the body of the redirect response here
2. Koa escapes the URL prior to including it in the body of the response here
3. Unfortunately, the escaping routine escapes for HTML, not for URLs here
4. For this reason, it is possible to mount a XSS attack by passing in a javascript URL to redirect.

Proof-of-concept:

const Koa = require('koa');
const app = new Koa();

app.use(async ctx => {
  ctx.redirect("javascript:alert(1);")
});

app.listen(3000);

Followed by: curl 'http://localhost:3000/'

[fgauthie]

I agree with @vladshcherbin comment. Developers are unlikely to be aware that Koa generates an HTML page before issuing a redirect and might simply dismiss non http(s): URLs as invalid redirect destinations.

[niftylettuce]

This is developer responsibility imo, closing. If you wish to open a code based PR for review (e.g. an option as @fl0w mentioned) or a PR to update the docs, it is more than welcome. Please reference this issue number in your commit/PR, thank you.