mirrors/axios
2
0
Fork 0
mirror of https://github.com/tenrok/axios.git synced 2026-06-11 18:02:32 +03:00
Code Activity

fix(sec): disregard protocol-relative URL to remediate SSRF (#6539)

Browse Source 
* fix(sec): disregard protocol-relative URL to remediate SSRF

Signed-off-by: hainenber <dotronghai96@gmail.com>

* feat(test/unit/regression): add regression test to ensure SNYK-JS-AXIOS-7361793 fixed in future version

Signed-off-by: hainenber <dotronghai96@gmail.com>

* chore: add EoF newline + comments

Signed-off-by: hainenber <dotronghai96@gmail.com>

* chore: fix eslint issues

Signed-off-by: hainenber <dotronghai96@gmail.com>

* Update SNYK-JS-AXIOS-7361793.js

Co-authored-by: tom-reinders <tom-reinders@users.noreply.github.com>

---------

Signed-off-by: hainenber <dotronghai96@gmail.com>
Co-authored-by: tom-reinders <tom-reinders@users.noreply.github.com>
This commit is contained in:
Đỗ Trọng Hải
2024-08-13 22:03:25 +07:00
committed by GitHub
parent c6cce43cd9
commit 07a661a2a6
3 changed files with 49 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/helpers/isAbsoluteURL.js
+2 -2
View File
@@ -8,8 +8,8 @@
* @returns {boolean} True if the specified URL is absolute, otherwise false
*/
export default function isAbsoluteURL(url) {
// A URL is considered absolute if it begins with "<scheme>://" or "//" (protocol-relative URL).
// A URL is considered absolute if it begins with "<scheme>://".
// RFC 3986 defines scheme name as a sequence of characters beginning with a letter and followed
// by any combination of letters, digits, plus, period, or hyphen.
return /^([a-z][a-z\d+\-.]*:)?\/\//i.test(url);
return /^([a-z][a-z\d+\-.]*:)\/\//i.test(url);
}