I believe carriage returns (\r or \0x0D) should be removed as well, looking at WPT tests: https://github.com/web-platform-tests/wpt/blob/master/url/url-setters-stripping.any.js#L18
Bug 1812060 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I believe carriage returns (\r or \0x0D) should be removed as well, looking at WPT tests: https://github.com/web-platform-tests/wpt/blob/master/url/resources/setters_tests.json#L276