According to this section in the spec, the file scheme can't have username/password/port. I think they also should be removed automatically when file: is added as the scheme. Currently, they are left in the href even they cannot be overwritten.
e.g.
var url = new URL('http://user:[email protected]:21/aaa/zzz?l=24#test');
url.protocol = 'file:';
// url.href:
// + expected: file://foo.bar.com/aaa/zzz?l=24#test
// + actual: "file://user:pass%40foo.bar.com:21/aaa/zzz?l=24#test"