axios 1.15.1 → 1.15.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +112 -44
- package/README.md +30 -0
- package/dist/axios.js +34 -11
- package/dist/axios.js.map +1 -1
- package/dist/axios.min.js +2 -2
- package/dist/axios.min.js.map +1 -1
- package/dist/browser/axios.cjs +32 -6
- package/dist/browser/axios.cjs.map +1 -1
- package/dist/esm/axios.js +32 -6
- package/dist/esm/axios.js.map +1 -1
- package/dist/esm/axios.min.js +2 -2
- package/dist/esm/axios.min.js.map +1 -1
- package/dist/node/axios.cjs +91 -37
- package/dist/node/axios.cjs.map +1 -1
- package/index.d.cts +1 -0
- package/index.d.ts +1 -0
- package/lib/adapters/http.js +69 -22
- package/lib/core/mergeConfig.js +13 -1
- package/lib/env/data.js +1 -1
- package/lib/helpers/resolveConfig.js +14 -2
- package/lib/helpers/validator.js +3 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,40 +1,108 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## v1.15.1 — April 19, 2026
|
|
4
|
+
|
|
5
|
+
This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.
|
|
6
|
+
|
|
7
|
+
## 🔒 Security Fixes
|
|
8
|
+
|
|
9
|
+
- **Header Injection Hardening:** Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (**#10749**)
|
|
10
|
+
|
|
11
|
+
- **CRLF Stripping in Multipart Headers:** Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (**#10758**)
|
|
12
|
+
|
|
13
|
+
- **Prototype Pollution / Auth Bypass:** Replaced unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (**#10761**, **#10760**)
|
|
14
|
+
|
|
15
|
+
- **`withXSRFToken` Truthy Bypass:** Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (**#10762**)
|
|
16
|
+
|
|
17
|
+
- **`maxBodyLength` With Zero Redirects:** Enforces `maxBodyLength` even when `maxRedirects` is set to `0`, closing a bypass path for oversized request bodies. (**#10753**)
|
|
18
|
+
|
|
19
|
+
- **Streamed Response `maxContentLength` Bypass:** Applies `maxContentLength` to streamed responses that previously bypassed the cap. (**#10754**)
|
|
20
|
+
|
|
21
|
+
- **Follow-up CVE Completion:** Completes an earlier incomplete CVE fix to fully close the regression window. (**#10755**)
|
|
22
|
+
|
|
23
|
+
## 🚀 New Features
|
|
24
|
+
|
|
25
|
+
- **AI-Based Docs Translations:** Initial scaffold for AI-assisted translations of the documentation site. (**#10705**)
|
|
26
|
+
|
|
27
|
+
- **`Location` Request Header Type:** Adds `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests. (**#7528**)
|
|
28
|
+
|
|
29
|
+
## 🐛 Bug Fixes
|
|
30
|
+
|
|
31
|
+
- **FormData Handling:** Removes `Content-Type` when no boundary is present on `FormData` fetch requests, supports multi-select fields, cancels `request.body` instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (**#7314**, **#10676**, **#10702**, **#10726**)
|
|
32
|
+
|
|
33
|
+
- **HTTP Adapter:** Handles socket-only request errors without leaking keep-alive listeners. (**#10576**)
|
|
34
|
+
|
|
35
|
+
- **Progress Events:** Clamps `loaded` to `total` for computable upload/download progress events. (**#7458**)
|
|
36
|
+
|
|
37
|
+
- **Types:** Aligns `runWhen` type with the runtime behaviour in `InterceptorManager` and makes response header keys case-insensitive. (**#7529**, **#10677**)
|
|
38
|
+
|
|
39
|
+
- **`buildFullPath`:** Uses strict equality in the base/relative URL check. (**#7252**)
|
|
40
|
+
|
|
41
|
+
- **`AxiosURLSearchParams` Regex:** Improves the regex used for param serialisation to avoid edge-case mismatches. (**#10736**)
|
|
42
|
+
|
|
43
|
+
- **Resilient Value Parsing:** Parses out header/config values instead of throwing on malformed input. (**#10687**)
|
|
44
|
+
|
|
45
|
+
- **Docs Artefact Cleanup:** Removes the docs content that was incorrectly committed. (**#10727**)
|
|
46
|
+
|
|
47
|
+
## 🔧 Maintenance & Chores
|
|
48
|
+
|
|
49
|
+
- **Threat Model & Security Docs:** Ongoing refinement of `THREATMODEL.md`, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (**#10672**, **#10715**, **#10718**, **#10722**, **#10763**, **#10765**)
|
|
50
|
+
|
|
51
|
+
- **Test Coverage & Migration:** Expanded `shouldBypassProxy` coverage for wildcard/IPv6/edge cases, documented and tested `AxiosError.status`, and migrated `progressEventReducer` tests to Vitest. (**#10723**, **#10725**, **#10741**)
|
|
52
|
+
|
|
53
|
+
- **Type Refactor:** Uses TypeScript utility types to deduplicate literal unions. (**#7520**)
|
|
54
|
+
|
|
55
|
+
- **Repo & CI:** Adds `CODEOWNERS`, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (**#10739**, **#10738**, **#10746**)
|
|
56
|
+
|
|
57
|
+
## 🌟 New Contributors
|
|
58
|
+
|
|
59
|
+
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
|
|
60
|
+
|
|
61
|
+
- **@curiouscoder-cmd** (**#7252**)
|
|
62
|
+
- **@tryonelove** (**#7520**)
|
|
63
|
+
- **@darwin808** (**#7314**)
|
|
64
|
+
- **@zoontek** (**#10702**)
|
|
65
|
+
- **@AKIB473** (**#10725**)
|
|
66
|
+
|
|
67
|
+
[Full Changelog](https://github.com/axios/axios/compare/v1.15.0...v1.15.1)
|
|
68
|
+
|
|
69
|
+
---
|
|
70
|
+
|
|
3
71
|
## v1.15.0 — April 7, 2026
|
|
4
72
|
|
|
5
73
|
This release delivers two critical security patches targeting header injection and SSRF via proxy bypass, adds official runtime support for Deno and Bun, and includes significant CI security hardening.
|
|
6
74
|
|
|
7
75
|
## 🔒 Security Fixes
|
|
8
76
|
|
|
9
|
-
|
|
77
|
+
- **Header Injection (CRLF):** Rejects any header value containing `\r` or `\n` characters to block CRLF injection chains that could be used to exfiltrate cloud metadata (IMDS). Behavior change: headers with CR/LF now throw `"Invalid character in header content"`. (**#10660**)
|
|
10
78
|
|
|
11
|
-
|
|
79
|
+
- **SSRF via `no_proxy` Bypass:** Introduces a `shouldBypassProxy` helper that normalises hostnames (strips trailing dots, handles bracketed IPv6) before evaluating `no_proxy`/`NO_PROXY` rules, closing a gap that could cause loopback or internal hosts to be inadvertently proxied. (**#10661**)
|
|
12
80
|
|
|
13
81
|
## 🚀 New Features
|
|
14
82
|
|
|
15
|
-
|
|
83
|
+
- **Deno & Bun Runtime Support:** Added full smoke test suites for Deno and Bun, with CI workflows that run both runtimes before any release is cut. (**#10652**)
|
|
16
84
|
|
|
17
85
|
## 🐛 Bug Fixes
|
|
18
86
|
|
|
19
|
-
|
|
87
|
+
- **Node.js v22 Compatibility:** Replaced deprecated `url.parse()` calls with the WHATWG `URL`/`URLSearchParams` API across examples, sandbox, and tests, eliminating `DEP0169` deprecation warnings on Node.js v22+. (**#10625**)
|
|
20
88
|
|
|
21
89
|
## 🔧 Maintenance & Chores
|
|
22
90
|
|
|
23
|
-
|
|
91
|
+
- **CI Security Hardening:** Added [zizmor](https://github.com/zizmorcore/zizmor) GitHub Actions security scanner; switched npm publish to OIDC Trusted Publishing (removing the long-lived `NODE_AUTH_TOKEN`); pinned all action references to full commit SHAs; narrowed workflow permissions to least privilege; gated the publish step behind a dedicated `npm-publish` environment; and blocked the sponsor-block workflow from running on forks. (**#10618**, **#10619**, **#10627**, **#10637**, **#10641**, **#10666**)
|
|
24
92
|
|
|
25
|
-
|
|
93
|
+
- **Docs:** Clarified HTTP/2 support and the unsupported `httpVersion` option; added documentation for header case preservation; improved the `beforeRedirect` example to prevent accidental credential leakage. (**#10644**, **#10654**, **#10624**)
|
|
26
94
|
|
|
27
|
-
|
|
95
|
+
- **Dependencies:** Bumped `picomatch`, `handlebars`, `serialize-javascript`, `vite` (×3), `denoland/setup-deno`, and 4 additional dev dependencies to latest versions. (**#10564**, **#10565**, **#10567**, **#10568**, **#10572**, **#10574**, **#10663**, **#10664**, **#10665**, **#10669**, **#10670**)
|
|
28
96
|
|
|
29
97
|
## 🌟 New Contributors
|
|
30
98
|
|
|
31
99
|
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
|
|
32
100
|
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
101
|
+
- **@Kilros0817** (**#10625**)
|
|
102
|
+
- **@shaanmajid** (**#10616**, **#10617**, **#10618**, **#10619**, **#10637**, **#10641**, **#10666**)
|
|
103
|
+
- **@ashstrc** (**#10624**, **#10644**)
|
|
104
|
+
- **@Abhi3975** (**#10589**)
|
|
105
|
+
- **@raashish1601** (**#10573**)
|
|
38
106
|
|
|
39
107
|
[Full Changelog](https://github.com/axios/axios/compare/v1.14.0...v1.15.0)
|
|
40
108
|
|
|
@@ -46,33 +114,33 @@ This release fixes a security vulnerability in the `formidable` dependency, reso
|
|
|
46
114
|
|
|
47
115
|
## 🔒 Security Fixes
|
|
48
116
|
|
|
49
|
-
|
|
117
|
+
- **Formidable Vulnerability:** Upgraded `formidable` from v2 to v3 to address a reported arbitrary-file vulnerability. Updated test server and assertions to align with the v3 API. (**#7533**)
|
|
50
118
|
|
|
51
119
|
## 🐛 Bug Fixes
|
|
52
120
|
|
|
53
|
-
|
|
121
|
+
- **CommonJS Compatibility:** Restored `require('axios')` in Node.js by correcting the `main` field in `package.json` to point to the built CJS bundle. (**#7532**)
|
|
54
122
|
|
|
55
|
-
|
|
123
|
+
- **Fetch Adapter:** Cancel the `ReadableStream` body after the request stream capability probe to prevent resource leaks. (**#7515**)
|
|
56
124
|
|
|
57
|
-
|
|
125
|
+
- **Proxy:** Upgraded `proxy-from-env` to v2 and switched to the named `getProxyForUrl` export, fixing proxy detection from environment variables and resolving CJS bundling errors. (**#7499**)
|
|
58
126
|
|
|
59
|
-
|
|
127
|
+
- **HTTP/2:** Close detached HTTP/2 sessions on timeout to free resources when no new requests arrive. (**#7457**)
|
|
60
128
|
|
|
61
|
-
|
|
129
|
+
- **Headers:** Trim trailing CRLF characters from normalised header values. (**#7456**)
|
|
62
130
|
|
|
63
131
|
## 🔧 Maintenance & Chores
|
|
64
132
|
|
|
65
|
-
|
|
133
|
+
- **Toolchain Modernisation:** Migrated test suite to Vitest, updated ESLint to v10, upgraded Rollup and `@rollup/plugin-babel`, migrated to Husky 9, upgraded TypeScript to latest, and modernised the Express test harness. (**#7484**, **#7489**, **#7498**, **#7505**, **#7506**, **#7507**, **#7508**, **#7509**, **#7510**, **#7516**, **#7522**)
|
|
66
134
|
|
|
67
|
-
|
|
135
|
+
- **Dependencies:** Bumped `multer` to v2, `minimatch`, `tar`, `pacote`, `@babel/preset-env`, and additional dev dependencies. (**#7453**, **#7480**, **#7491**, **#7504**, **#7517**, **#7531**)
|
|
68
136
|
|
|
69
137
|
## 🌟 New Contributors
|
|
70
138
|
|
|
71
139
|
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
|
|
72
140
|
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
141
|
+
- **@penkzhou** (**#7515**)
|
|
142
|
+
- **@aviu16** (**#7456**)
|
|
143
|
+
- **@fedotov** (**#7457**)
|
|
76
144
|
|
|
77
145
|
[Full Changelog](https://github.com/axios/axios/compare/v1.13.6...v1.14.0)
|
|
78
146
|
|
|
@@ -84,31 +152,31 @@ This release adds React Native Blob support, fixes several enumeration and expor
|
|
|
84
152
|
|
|
85
153
|
## 🚀 New Features
|
|
86
154
|
|
|
87
|
-
|
|
155
|
+
- **React Native Blob Support:** Axios now correctly handles native Blob objects in React Native environments. (**#5764**)
|
|
88
156
|
|
|
89
157
|
## 🐛 Bug Fixes
|
|
90
158
|
|
|
91
|
-
|
|
159
|
+
- **AxiosError:** Fixed `AxiosError.from` not copying the `status` field from the source error. (**#7403**)
|
|
92
160
|
|
|
93
|
-
|
|
161
|
+
- **AxiosError:** Made the `message` property enumerable so it appears in `JSON.stringify` output and `Object.keys`. (**#7392**)
|
|
94
162
|
|
|
95
|
-
|
|
163
|
+
- **FormData Detection:** Corrected safe FormData detection for WeChat Mini Program environments. (**#7324**)
|
|
96
164
|
|
|
97
|
-
|
|
165
|
+
- **React Native / Browserify Export:** Fixed broken module export that caused import failures in React Native and Browserify. (**#7386**)
|
|
98
166
|
|
|
99
167
|
## 🔧 Maintenance & Chores
|
|
100
168
|
|
|
101
|
-
|
|
169
|
+
- **Dependencies:** Migrated `@rollup/plugin-babel` from v5 to v6 and bumped the development dependencies group. (**#7424**, **#7432**)
|
|
102
170
|
|
|
103
171
|
## 🌟 New Contributors
|
|
104
172
|
|
|
105
173
|
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
|
|
106
174
|
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
175
|
+
- **@moh3n9595** (**#5764**)
|
|
176
|
+
- **@skrtheboss** (**#7403**)
|
|
177
|
+
- **@ybbus** (**#7392**)
|
|
178
|
+
- **@Shiwaangee** (**#7324**)
|
|
179
|
+
- **@Gudahtt** (**#7386**)
|
|
112
180
|
|
|
113
181
|
[Full Changelog](https://github.com/axios/axios/compare/v1.13.5...v1.13.6)
|
|
114
182
|
|
|
@@ -120,29 +188,29 @@ This release patches a prototype pollution denial-of-service vulnerability, fixe
|
|
|
120
188
|
|
|
121
189
|
## 🔒 Security Fixes
|
|
122
190
|
|
|
123
|
-
|
|
191
|
+
- **Prototype Pollution (DoS):** Hardened `mergeConfig` to ignore `__proto__`, `constructor`, and `prototype` keys, preventing denial-of-service via prototype pollution when merging user-supplied config. (**#7369**)
|
|
124
192
|
|
|
125
193
|
## 🚀 New Features
|
|
126
194
|
|
|
127
|
-
|
|
195
|
+
- **`isAbsoluteURL` Validation:** Added input validation to `isAbsoluteURL` to handle malformed or unexpected input gracefully. (**#7326**)
|
|
128
196
|
|
|
129
197
|
## 🐛 Bug Fixes
|
|
130
198
|
|
|
131
|
-
|
|
199
|
+
- **AxiosError `status`:** Restored the `status` field on `AxiosError` instances, which was missing in v1.13.3 and later. (**#7368**)
|
|
132
200
|
|
|
133
|
-
|
|
201
|
+
- **Interceptor Ordering:** Added a `useLegacyInterceptorOrder` option to restore pre-v1.13 interceptor execution order for applications relying on the previous behaviour. ([569f028](https://github.com/axios/axios/commit/569f028a5878faaec8d7d138ba686aac407bda4c))
|
|
134
202
|
|
|
135
203
|
## 🔧 Maintenance & Chores
|
|
136
204
|
|
|
137
|
-
|
|
205
|
+
- **CI:** Fixed run conditions and updated workflow YAMLs. (**#7372**, **#7373**)
|
|
138
206
|
|
|
139
|
-
|
|
207
|
+
- **Dependencies:** Bumped `karma-sourcemap-loader` and minor package versions. (**#7356**, **#7360**)
|
|
140
208
|
|
|
141
209
|
## 🌟 New Contributors
|
|
142
210
|
|
|
143
211
|
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
|
|
144
212
|
|
|
145
|
-
|
|
213
|
+
- **@asmitha-16** (**#7326**)
|
|
146
214
|
|
|
147
215
|
[Full Changelog](https://github.com/axios/axios/compare/v1.13.4...v1.13.5)
|
|
148
216
|
|
|
@@ -154,13 +222,13 @@ Patch release fixing regressions introduced in v1.13.3, including TypeScript exp
|
|
|
154
222
|
|
|
155
223
|
## 🐛 Bug Fixes
|
|
156
224
|
|
|
157
|
-
|
|
225
|
+
- **v1.13.3 Regressions:** Fixed multiple issues introduced by the v1.13.3 release, including broken merge configs. (**#7352**)
|
|
158
226
|
|
|
159
|
-
|
|
227
|
+
- **TypeScript Exports:** Corrected TypeScript export declarations to restore proper type resolution. (**#4884**)
|
|
160
228
|
|
|
161
229
|
## 🔧 Maintenance & Chores
|
|
162
230
|
|
|
163
|
-
|
|
231
|
+
- **CI & Build:** Refactored CI pipeline and build configuration for stability. (**#7340**)
|
|
164
232
|
|
|
165
233
|
[Full Changelog](https://github.com/axios/axios/compare/v1.13.3...v1.13.4)
|
|
166
234
|
|
package/README.md
CHANGED
|
@@ -92,6 +92,8 @@
|
|
|
92
92
|
- [Semver](#semver)
|
|
93
93
|
- [Promises](#promises)
|
|
94
94
|
- [TypeScript](#typescript)
|
|
95
|
+
- [Contributing](#contributing)
|
|
96
|
+
- [Local setup](#local-setup)
|
|
95
97
|
- [Resources](#resources)
|
|
96
98
|
- [Credits](#credits)
|
|
97
99
|
- [License](#license)
|
|
@@ -598,8 +600,19 @@ These are the available config options for making requests. Only the `url` is re
|
|
|
598
600
|
// e.g. '/var/run/docker.sock' to send requests to the docker daemon.
|
|
599
601
|
// Only either `socketPath` or `proxy` can be specified.
|
|
600
602
|
// If both are specified, `socketPath` is used.
|
|
603
|
+
//
|
|
604
|
+
// Security: when `socketPath` is set, hostname/port of the URL are ignored,
|
|
605
|
+
// which bypasses hostname-based SSRF protections. Never derive `socketPath`
|
|
606
|
+
// from untrusted input. Use `allowedSocketPaths` (below) to restrict accepted
|
|
607
|
+
// socket paths for defense-in-depth.
|
|
601
608
|
socketPath: null, // default
|
|
602
609
|
|
|
610
|
+
// `allowedSocketPaths` restricts which `socketPath` values are accepted.
|
|
611
|
+
// Accepts a string or array of strings. Entries and the incoming socketPath
|
|
612
|
+
// are compared after path.resolve(). A mismatch throws AxiosError with code
|
|
613
|
+
// `ERR_BAD_OPTION_VALUE`. When null/undefined, no restriction is applied.
|
|
614
|
+
allowedSocketPaths: null, // default
|
|
615
|
+
|
|
603
616
|
// `transport` determines the transport method that will be used to make the request.
|
|
604
617
|
// If defined, it will be used. Otherwise, if `maxRedirects` is 0,
|
|
605
618
|
// the default `http` or `https` library will be used, depending on the protocol specified in `protocol`.
|
|
@@ -2009,6 +2022,23 @@ You can use Gitpod, an online IDE(which is free for Open Source) for contributin
|
|
|
2009
2022
|
|
|
2010
2023
|
[](https://gitpod.io/#https://github.com/axios/axios/blob/main/examples/server.js)
|
|
2011
2024
|
|
|
2025
|
+
## Contributing
|
|
2026
|
+
|
|
2027
|
+
### Local setup
|
|
2028
|
+
|
|
2029
|
+
As a supply-chain hardening measure, this repository ships a project-level `.npmrc` that sets `ignore-scripts=true`. This blocks npm lifecycle scripts (`preinstall`, `install`, `postinstall`, `prepare`) from any direct or transitive dependency when you run `npm install` or `npm ci` inside the repo. See [THREATMODEL.md](./THREATMODEL.md) (threat T-S2) for the rationale.
|
|
2030
|
+
|
|
2031
|
+
One consequence: the repository's own `prepare` hook (which installs Husky's git hooks) will **not** run automatically. After your first install, enable the git hooks manually:
|
|
2032
|
+
|
|
2033
|
+
```bash
|
|
2034
|
+
npm ci
|
|
2035
|
+
npm rebuild husky && npx husky
|
|
2036
|
+
```
|
|
2037
|
+
|
|
2038
|
+
Run those two commands once per fresh checkout. You do **not** need to re-run them after every subsequent `npm install`.
|
|
2039
|
+
|
|
2040
|
+
Do not remove `ignore-scripts=true` from `.npmrc` to "fix" this — that re-opens the lifecycle-script attack surface for every other package in the tree. All CI workflows already invoke npm with `--ignore-scripts`, so local behaviour matches CI.
|
|
2041
|
+
|
|
2012
2042
|
## Resources
|
|
2013
2043
|
|
|
2014
2044
|
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
|
package/dist/axios.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! Axios v1.15.
|
|
1
|
+
/*! Axios v1.15.2 Copyright (c) 2026 Matt Zabriskie and contributors */
|
|
2
2
|
(function (global, factory) {
|
|
3
3
|
typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
|
|
4
4
|
typeof define === 'function' && define.amd ? define(factory) :
|
|
@@ -2843,7 +2843,18 @@
|
|
|
2843
2843
|
function mergeConfig(config1, config2) {
|
|
2844
2844
|
// eslint-disable-next-line no-param-reassign
|
|
2845
2845
|
config2 = config2 || {};
|
|
2846
|
-
|
|
2846
|
+
|
|
2847
|
+
// Use a null-prototype object so that downstream reads such as `config.auth`
|
|
2848
|
+
// or `config.baseURL` cannot inherit polluted values from Object.prototype
|
|
2849
|
+
// (see GHSA-q8qp-cvcw-x6jj). `hasOwnProperty` is restored as a non-enumerable
|
|
2850
|
+
// own slot to preserve ergonomics for user code that relies on it.
|
|
2851
|
+
var config = Object.create(null);
|
|
2852
|
+
Object.defineProperty(config, 'hasOwnProperty', {
|
|
2853
|
+
value: Object.prototype.hasOwnProperty,
|
|
2854
|
+
enumerable: false,
|
|
2855
|
+
writable: true,
|
|
2856
|
+
configurable: true
|
|
2857
|
+
});
|
|
2847
2858
|
function getMergedValue(target, source, prop, caseless) {
|
|
2848
2859
|
if (utils$1.isPlainObject(target) && utils$1.isPlainObject(source)) {
|
|
2849
2860
|
return utils$1.merge.call({
|
|
@@ -2915,6 +2926,7 @@
|
|
|
2915
2926
|
httpsAgent: defaultToConfig2,
|
|
2916
2927
|
cancelToken: defaultToConfig2,
|
|
2917
2928
|
socketPath: defaultToConfig2,
|
|
2929
|
+
allowedSocketPaths: defaultToConfig2,
|
|
2918
2930
|
responseEncoding: defaultToConfig2,
|
|
2919
2931
|
validateStatus: mergeDirectKeys,
|
|
2920
2932
|
headers: function headers(a, b, prop) {
|
|
@@ -2934,14 +2946,23 @@
|
|
|
2934
2946
|
|
|
2935
2947
|
var resolveConfig = (function (config) {
|
|
2936
2948
|
var newConfig = mergeConfig({}, config);
|
|
2937
|
-
|
|
2938
|
-
|
|
2939
|
-
|
|
2940
|
-
|
|
2941
|
-
|
|
2942
|
-
|
|
2949
|
+
|
|
2950
|
+
// Read only own properties to prevent prototype pollution gadgets
|
|
2951
|
+
// (e.g. Object.prototype.baseURL = 'https://evil.com'). See GHSA-q8qp-cvcw-x6jj.
|
|
2952
|
+
var own = function own(key) {
|
|
2953
|
+
return utils$1.hasOwnProp(newConfig, key) ? newConfig[key] : undefined;
|
|
2954
|
+
};
|
|
2955
|
+
var data = own('data');
|
|
2956
|
+
var withXSRFToken = own('withXSRFToken');
|
|
2957
|
+
var xsrfHeaderName = own('xsrfHeaderName');
|
|
2958
|
+
var xsrfCookieName = own('xsrfCookieName');
|
|
2959
|
+
var headers = own('headers');
|
|
2960
|
+
var auth = own('auth');
|
|
2961
|
+
var baseURL = own('baseURL');
|
|
2962
|
+
var allowAbsoluteUrls = own('allowAbsoluteUrls');
|
|
2963
|
+
var url = own('url');
|
|
2943
2964
|
newConfig.headers = headers = AxiosHeaders.from(headers);
|
|
2944
|
-
newConfig.url = buildURL(buildFullPath(
|
|
2965
|
+
newConfig.url = buildURL(buildFullPath(baseURL, url, allowAbsoluteUrls), config.params, config.paramsSerializer);
|
|
2945
2966
|
|
|
2946
2967
|
// HTTP basic authentication
|
|
2947
2968
|
if (auth) {
|
|
@@ -3889,7 +3910,7 @@
|
|
|
3889
3910
|
});
|
|
3890
3911
|
}
|
|
3891
3912
|
|
|
3892
|
-
var VERSION = "1.15.
|
|
3913
|
+
var VERSION = "1.15.2";
|
|
3893
3914
|
|
|
3894
3915
|
var validators$1 = {};
|
|
3895
3916
|
|
|
@@ -3954,7 +3975,9 @@
|
|
|
3954
3975
|
var i = keys.length;
|
|
3955
3976
|
while (i-- > 0) {
|
|
3956
3977
|
var opt = keys[i];
|
|
3957
|
-
|
|
3978
|
+
// Use hasOwnProperty so a polluted Object.prototype.<opt> cannot supply
|
|
3979
|
+
// a non-function validator and cause a TypeError. See GHSA-q8qp-cvcw-x6jj.
|
|
3980
|
+
var validator = Object.prototype.hasOwnProperty.call(schema, opt) ? schema[opt] : undefined;
|
|
3958
3981
|
if (validator) {
|
|
3959
3982
|
var value = options[opt];
|
|
3960
3983
|
var result = value === undefined || validator(value, opt, options);
|