escape rootURL and baseURL before regexp in getURL

packages/@ember/routing/history-location.ts

@@ -1,7 +1,7 @@
 import EmberObject from '@ember/object';
 import { assert } from '@ember/debug';
 import type { default as EmberLocation, UpdateCallback } from '@ember/routing/location';
-import { getHash } from './lib/location-utils';
+import { escapeRegExp, getHash } from './lib/location-utils';
 
 /**
 @module @ember/routing/history-location
@@ -134,8 +134,8 @@ export default class HistoryLocation extends EmberObject implements EmberLocatio
 
     // remove baseURL and rootURL from start of path
     let url = path
-      .replace(new RegExp(`^${baseURL}(?=/|$)`), '')
-      .replace(new RegExp(`^${rootURL}(?=/|$)`), '')
+      .replace(new RegExp(`^${escapeRegExp(baseURL)}(?=/|$)`), '')
+      .replace(new RegExp(`^${escapeRegExp(rootURL)}(?=/|$)`), '')
       .replace(/\/\//g, '/'); // remove extra slashes
 
     let search = location.search || '';

packages/@ember/routing/lib/location-utils.ts

@@ -1,3 +1,16 @@
+/**
+  @private
+
+  Escapes any regular-expression metacharacters in `str` so it can be safely
+  interpolated into a `RegExp` and matched as a literal.
+
+  TODO: delete this in favor of `RegExp.escape` once our minimum supported
+  browsers all include it (https://caniuse.com/mdn-javascript_builtins_regexp_escape).
+*/
+export function escapeRegExp(str: string): string {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 /**
   @private
 

packages/@ember/routing/none-location.ts

@@ -1,6 +1,7 @@
 import EmberObject from '@ember/object';
 import { assert } from '@ember/debug';
 import type { default as EmberLocation, UpdateCallback } from '@ember/routing/location';
+import { escapeRegExp } from './lib/location-utils';
 
 /**
 @module @ember/routing/none-location
@@ -63,7 +64,7 @@ export default class NoneLocation extends EmberObject implements EmberLocation {
     rootURL = rootURL.replace(/\/$/, '');
 
     // remove rootURL from url
-    return path.replace(new RegExp(`^${rootURL}(?=/|$)`), '');
+    return path.replace(new RegExp(`^${escapeRegExp(rootURL)}(?=/|$)`), '');
   }
 
   /**

packages/@ember/routing/tests/location/history_location_test.js

@@ -319,6 +319,23 @@ moduleFor(
       assert.equal(location.getURL(), '/admin/profile/');
     }
 
+    ['@test HistoryLocation.getURL() treats regex metacharacters in rootURL and baseURL literally'](
+      assert
+    ) {
+      HistoryTestLocation.reopen({
+        init() {
+          this._super(...arguments);
+          set(this, 'location', mockBrowserLocation('/axc/secret'));
+          set(this, 'rootURL', '/a.c/');
+          set(this, 'baseURL', '/a.c/');
+        },
+      });
+
+      createLocation();
+
+      assert.equal(location.getURL(), '/axc/secret');
+    }
+
     ['@test Existing state is preserved on init'](assert) {
       let existingState = {
         path: '/route/path',

packages/@ember/routing/tests/location/none_location_test.js

@@ -84,5 +84,33 @@ moduleFor(
 
       assert.equal(location.getURL(), '/bars/baz');
     }
+
+    ['@test NoneLocation.getURL() treats regex metacharacters in rootURL literally'](assert) {
+      NoneTestLocation.reopen({
+        init() {
+          this._super(...arguments);
+          set(this, 'rootURL', '/a.c/');
+          set(this, 'path', '/axc/secret');
+        },
+      });
+
+      createLocation();
+
+      assert.equal(location.getURL(), '/axc/secret');
+    }
+
+    ['@test NoneLocation.getURL() strips the rootURL when it has an extra trailing slash'](assert) {
+      NoneTestLocation.reopen({
+        init() {
+          this._super(...arguments);
+          set(this, 'rootURL', '/foo//');
+          set(this, 'path', '/foo//bar');
+        },
+      });
+
+      createLocation();
+
+      assert.equal(location.getURL(), '/bar');
+    }
   }
 );