fix(utils): make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#5661)

lib/utils.js

@@ -188,12 +188,16 @@ const isStream = (val) => isObject(val) && isFunction(val.pipe);
  * @returns {boolean} True if value is an FormData, otherwise false
  */
 const isFormData = (thing) => {
-  const pattern = '[object FormData]';
+  let kind;
   return thing && (
-    (typeof FormData === 'function' && thing instanceof FormData) ||
+    (typeof FormData === 'function' && thing instanceof FormData) || (
-    toString.call(thing) === pattern ||
+      isFunction(thing.append) && (
-    (isFunction(thing.toString) && thing.toString() === pattern)
+        (kind = kindOf(thing)) === 'formdata' ||
-  );
+        // detect form-data instance
+        (kind === 'object' && isFunction(thing.toString) && thing.toString() === '[object FormData]')
+      )
+    )
+  )
 }
 
 /**

test/unit/utils/utils.js

@@ -22,6 +22,37 @@ describe('utils', function (){
       });
       assert.equal(utils.isFormData(new FormData()), true);
     });
+
+    it('should not call toString method on built-in objects instances', () => {
+      const buf = Buffer.from('123');
+
+      buf.toString = () => assert.fail('should not be called');
+
+      assert.equal(utils.isFormData(buf), false);
+    });
+
+    it('should not call toString method on built-in objects instances, even if append method exists', () => {
+      const buf = Buffer.from('123');
+
+      buf.append = () => {};
+
+      buf.toString = () => assert.fail('should not be called');
+
+      assert.equal(utils.isFormData(buf), false);
+    });
+
+    it('should detect custom FormData instances by toStringTag signature and append method presence', () => {
+      class FormData {
+        append(){
+
+        }
+
+        get [Symbol.toStringTag]() {
+          return 'FormData';
+        }
+      }
+      assert.equal(utils.isFormData(new FormData()), true);
+    });
   });
 
   describe('toJSON', function (){