fix: preserve original URL string in Location header to prevent percent-encoding corruption (#5319)

[waterWang]

Summary

Fixes #5319

When a server-side redirect (via raise HTTPFound(...) or any other HTTPMove subclass) is sent with a location that contains percent-encoded characters (e.g. %3F for ? in a query string argument that is itself a URL), aiohttp re-encoded the URL through yarl.URL, decoding %3F to ?. Some downstream web servers reject the resulting URL because it then contains a second literal ?.

Root cause

In HTTPMove.__init__, the Location header was set from str(self.location), where self.location is the yarl.URL parsed form. yarl normalizes the URL, decoding percent-encoded query characters, so the header no longer matches the exact URL the user supplied.

Fix

• Set the Location header from the original location string (str(location)) instead of the parsed-and-re-encoded URL, so percent-encoding is preserved exactly.
• Keep URL(location) for validation and for the .location property (which still returns the parsed URL).
• Strip CR/LF from the header value for request-smuggling-style header-injection safety.

Testing

Added manual verification covering: basic string location, percent-encoding preservation, complex nested-URL query strings, CRLF stripping, empty/None location (ValueError), the .location property, and pickle round-trip for all HTTPMove subclasses.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.99%. Comparing base (288cf46) to head (004c9e5).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #13357   +/-   ##
=======================================
  Coverage   98.99%   98.99%           
=======================================
  Files         132      132           
  Lines       49156    49156           
  Branches     2560     2560           
=======================================
  Hits        48661    48661           
  Misses        371      371           
  Partials      124      124           

Flag	Coverage Δ
Autobahn	22.10% <0.00%> (ø)
CI-GHA	98.90% <100.00%> (+<0.01%)	⬆️
OS-Linux	98.67% <100.00%> (+<0.01%)	⬆️
OS-Windows	97.02% <100.00%> (ø)
OS-macOS	97.92% <100.00%> (-0.01%)	⬇️
Py-3.10	98.12% <100.00%> (ø)
Py-3.11	98.38% <100.00%> (ø)
Py-3.12	98.46% <100.00%> (ø)
Py-3.13	98.45% <100.00%> (ø)
Py-3.14	98.46% <100.00%> (-0.01%)	⬇️
Py-3.14t	97.55% <100.00%> (+<0.01%)	⬆️
Py-pypy-3.11	97.40% <100.00%> (-0.02%)	⬇️
VM-macos	97.92% <100.00%> (-0.01%)	⬇️
VM-ubuntu	98.67% <100.00%> (+<0.01%)	⬆️
VM-windows	97.02% <100.00%> (ø)
cython-coverage	38.06% <66.66%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 84 untouched benchmarks
⏩ 83 skipped benchmarks¹

---

_{Comparing waterWang:fix/redirect-url-requoting-5319 (004c9e5) with master (288cf46)}

Footnotes

1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩