Commit Graph

368 Commits

Author SHA1 Message Date
Julian Hollmann
83ae3830e4
Correctly add response interceptors to interceptor chain (#4013) 2021-09-04 20:55:38 +02:00
ready-research
5b457116e3
Security fix for ReDoS (#3980) 2021-08-30 14:33:43 +02:00
Daniel Lopretto
dbc634cf70
Remove charset in tests (#3807)
* removed charset setting when setting default header

* Remove charset from tests

Co-authored-by: mpark86 <dev.minuk.park@gmail.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
Co-authored-by: Pilot <timemachine@ctrl-c.club>
2021-05-21 07:51:31 +02:00
Philipe Gouveia Paixão
199c8aab64
Adding parseInt to config.timeout (#3781)
* Adding parseInt to config.timeout

* Fixing test message
2021-05-06 15:54:22 +02:00
Mark
0ece97c7a9
Fixing quadratic runtime when setting a maxContentLength (#3738)
Previously checking whether a response has exceeded `maxContentLength` was
quadratic with respect to the number of chunks in the response stream and
also caused unnecessary additional memory usage.

Co-authored-by: Jay <jasonsaayman@gmail.com>
2021-05-04 19:48:20 +02:00
TagawaHirotaka
a18a0eccb5
Updating lib/core/README.md about Dispatching requests (#3772)
* Updating lib/core/README.md :Dispatching requests

* Fixing expression
2021-04-30 09:08:50 +02:00
Dmitriy Mozgovoy
5ad6994da3
JSON improvements: throw if JSON parsing failed; number, boolean can be passed directly as payload for encoding to JSON #2613, #61, #907 (#3688)
* Draft

* Added support for primitive types to be converted to JSON if the request Content-Type is 'application/json';
Added throwing SyntaxError if JSON parsing failed and responseType is json;
Added transitional option object;
Added options validator to assert transitional options;
Added transitional option `silentJSONParsing= true` for backward compatibility;
Updated README.md;
Updated typings;

* Fixed isOlderVersion helper;
Fixed typo;
Added validator.spec.js;

* Added forcedJSONParsing transitional option #2791

* `transformData` is now called in the default configuration context if the function context is not specified (for tests compatibility);

* Added `transitional.clarifyTimeoutError` to throw ETIMEDOUT error instead of generic ECONNABORTED on request timeouts;
Added support of onloadend handler if available instead of onreadystatechange;
Added xhr timeout test;
Fixed potential bug of xhr adapter with proper handling timeouts&errors (FakeXMLHTTPRequest failed to handle timeouts);
2021-04-19 18:55:34 +02:00
Mike Bishop
b0959f0301
Adding ability to omit User-Agent header (#3703)
* Adding ability to omit User-Agent header

* Update line to be more compact

* Add unit tests for user-agent cases

Co-authored-by: Jay <jasonsaayman@gmail.com>
2021-03-29 16:47:29 +02:00
Daniel Lopretto
f2057f77b2
Testing and cleanup of transformResponse (#3377)
- Tests for transformResponse
 - Remove eslint error by renaming the var
 - Test that there data a length to avoid JSON.parse headache
 - Use `util.isString()` over `typeof`

Co-authored-by: Jay <jasonsaayman@gmail.com>
2021-03-24 08:22:03 +02:00
Sasha Korotkov
62d6256039
issue#2609 | Sasha | predictable axios requests (#2702)
* issue#2609 | Sasha | predictable axios requests

- axios requests are not delayed by pre-emptive promise creation by default
- add options to interceptors api ("synchronous" and "runWhen")
- add documentation and unit tests

* issue#2609 | Sasha | pull request feedback changes

* issue#2609 | Sasha | additional feedback changes

* issue#2609 | Sasha | put back try/catch

* issue#2609 | Sasha | add 2 adapter unit tests

- remove check for requestCancelled

Co-authored-by: ak71845 <alexandre.korotkov@kroger.com>
Co-authored-by: Xianming Zhong <chinesedfan@qq.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2021-03-01 11:11:35 +02:00
Daniel Lopretto
59ab559386
Update dev dependencies (#3401)
- Everything still works as expected.
  - Remove bundlesize
    - It still uses libtorb which is deprecated and broken on Win and
      requires a full suite of build tools on Mac. Keeping it in the
      package makes it difficult for anyone filing issues to run tests.
    - See: #3396
  - Update grunt and it's plugins
  - Update karma to v4...so much faster!
    - Changed the karma config. Better changes: #3394
  - Update Webpack
    - Uses terser over uglify
  - Update eslint
    - Caused an error in util.js from the `global` directive so the
      directive is removed (it was not needed).
  - Update typescript
    - The old version of tsc didn't know about new features in
      @types/node (like `asserts value`).

Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-12-16 10:25:06 +02:00
Jonathan Foster
e426910be7
Protocol not parsed when setting proxy config from env vars (#3070)
* Fixing proxy protocol config when parsed from env vars

* Adding instructions to specify proxy protocol when setting proxy config

* Moved HTTPS proxy config instruction closer to example

* Clear https_proxy env var so as to not impact other tests
2020-12-03 09:36:50 +02:00
Daniel Lopretto
c7329fefc8
Hotfix: Prevent SSRF (#3410)
* Reproducing the Vulnerability

* Prevent SSRF

* Cleanup

* Refactor to skip duplicate code

* Tests for correct passed data.

* Code review changes.
2020-11-24 08:44:00 +02:00
Jason Kwok
f472e5da5f
Adding a type guard for AxiosError (#2949)
Co-authored-by: Jason Kwok <JasonHK@users.noreply.github.com>
2020-11-03 10:01:07 +02:00
George Cheng
9a78465a92
Revert "Fixing overwrite Blob/File type as Content-Type in browser. (#1773)" (#3289)
This reverts commit f3cc053fb9.
2020-10-13 10:19:37 +02:00
Xianming Zhong
fa3673710e
fix axios.delete ignores config.data (#3282)
Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-10-01 09:46:32 +02:00
Allan Cruz
04d45f2091
Fixing requestHeaders.Authorization (#3287) 2020-09-20 10:19:48 +08:00
Cr
16aa2ce7fa
Fixing response with utf-8 BOM can not parse to json (#2419)
* fix: remove byte order marker (UTF-8 BOM) when transform response

* fix: remove BOM only utf-8

* test: utf-8 BOM

* fix: incorrect param name

Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-07-01 19:14:52 +02:00
Xianming Zhong
0d69a79c81
Refactor mergeConfig without utils.deepMerge (#2844)
* Adding failing test

* Fixing #2587 default custom config persisting

* Adding Concat keys and filter duplicates

* Fixed value from CPE

* update for review feedbacks

* no deepMerge

* only merge between plain objects

* fix rename

* always merge config by mergeConfig

* extract function mergeDeepProperties

* refactor mergeConfig with all keys, and add special logic for validateStatus

* add test for resetting headers

* add lots of tests and fix a bug

* should not inherit `data`

* use simple toString

* revert #1845

Co-authored-by: David Tanner <david.tanner@lifeomic.com>
Co-authored-by: Justin Beckwith <justin.beckwith@gmail.com>
2020-06-08 20:52:45 +02:00
Martti Laine
487941663b
Allow unsetting headers by passing null (#382) (#1845)
Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-06-04 20:57:54 +02:00
George Cheng
f3cc053fb9
Fixing overwrite Blob/File type as Content-Type in browser. (#1773)
Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-05-28 21:28:40 +02:00
Jay
f2b478f7ff
Revert "Fixing default transformRequest with buffer pools (#1511)" (#2982)
This reverts commit a9a3b5e22b.
2020-05-27 20:05:26 +02:00
Zac Delventhal
a9a3b5e22b
Fixing default transformRequest with buffer pools (#1511)
* Fixing default transformRequest of TypedArrays with buffer pools

A buffer pool is a large ArrayBuffer of a preset size used with a TypedArray
such as Uint8Array. This can speed up performance when constructing TypedArrays
of unknown sizes, and is a technique used by Node with their Buffers, and
by libraries like dcodeIO/protobuf.js.

Because the ArrayBuffer of such a TypedArray is much longer than the array
itself, using `.buffer` to transform the array before POSTing results in
sending a request with many extraneous empty bytes, which is wastefule and may
result in unexpected behavior.

Using `.slice()` before grabbing the ArrayBuffer fixes the problem by creating
a new TypedArray with a buffer of the expected length.

Signed-off-by: Zac Delventhal <delventhalz@gmail.com>

* Adding test for using default transformRequest with buffer pools

Adds a new test to the default transformRequest, running it on a
Uint8Array with a byte length of 16, but a much larger ArrayBuffer
with a byte length of 256. The transformed array should not include
any extra bytes, and so must have a byte length of just 16.

Signed-off-by: Zac Delventhal <delventhalz@gmail.com>

Co-authored-by: Zac Delventhal <zac@bitwise.io>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-05-27 14:42:41 +02:00
David
8a8c534a60
Fixing special char encoding (#1671)
* removing @ character from replacement list since it is a reserved character

* Updating buildURL test to not include the @ character

* Removing console logs

Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-05-27 14:37:39 +02:00
Petr Mares
5effc0827e
Fixing password encoding with special characters in basic authentication (#1492)
* Fixing password encoding with special characters in basic authentication

* Adding test to check if password with non-Latin1 characters pass

Co-authored-by: petr.mares <petr.mares@linecorp.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-05-26 18:32:03 +02:00
huangzuizui
a98755c00a
fix 'Network Error' in react native android (#1487)
There is a bug in react native Android platform when using get method.  It will trigger a 'Network Error' when passing the requestData which is an empty string to request.send function. So if the  requestData is an empty string we can set it to null as well to fix the bug.

Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-05-23 19:06:10 +02:00
Jay
cbda78552b
Revert "Bug/allow header to contain http verb keys #1252 (#1258)" (#2977)
This reverts commit 920510b3a6.
2020-05-22 21:44:26 +02:00
David Ko
920510b3a6
Bug/allow header to contain http verb keys #1252 (#1258)
* Failing test for #1252

* Only delete header keys that match an HTTP verb if the value is a non-string

Co-authored-by: David Ko <david.ko@pvtmethod.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-05-22 21:26:10 +02:00
Ryan Bown
1cdf9e4039
Fixing Cookie Helper with Asyc Components (#1105) (#1107)
Co-authored-by: Jay <jasonsaayman@gmail.com>
2020-05-22 16:44:17 +02:00
Alan Wang
885ada6d9b
Fixing getting local files (file://) failed (#2470)
* fix issue #2416, #2396

* fix Eslint warn

* Modify judgment conditions

* add unit test

* update unit test

* update unit test
2020-03-23 21:49:38 +08:00
Spencer von der Ohe
42eb9dfabc
Adding option to disable automatic decompression (#2661)
* Adding ability to disable auto decompression

* Updating decompress documentation in README

* Fixing test\unit\adapters\http.js lint errors

* Adding test for disabling auto decompression

* Removing changes that fixed lint errors in tests

* Removing formating change to unit test

Co-authored-by: Xianming Zhong <chinesedfan@qq.com>
2020-03-06 22:01:58 +08:00
Gustavo López
6642ca9aa1
Add independent maxBodyLength option (#2781)
* Add independent option to set the maximum size of the request body

* Remove maxBodyLength check

* Update README

* Assert for error code and message
2020-03-06 21:55:19 +08:00
Thibault Ehrhart
17a967123c
Adding responseEncoding to mergeConfig (#1745)
Co-authored-by: Xianming Zhong <chinesedfan@qq.com>
2020-02-15 21:49:26 +08:00
Nikita Galkin
12e00b8018
Fixing issue for HEAD method and gziped repsonse (#2666) 2020-02-15 18:10:58 +08:00
Xianming Zhong
56b72bbd2c
Compatible with follow-redirect aborts the request (#2689)
* Compatible with follow-redirect aborts the request

* Use the error code
2020-02-15 13:41:08 +08:00
Jonathan Sharpe
77f0ae4f61
Fix merging of params (#2656)
* Name function to avoid ESLint func-names warning

* Switch params config to merge list and update tests

* Restore testing of both false and null

* Restore test cases for keys without defaults

* Include test for non-object values that aren't false-y.
2020-02-15 13:36:52 +08:00
Xianming Zhong
c7488c7dd5 Remove unnecessary XSS check introduced by #2451 (#2679)
* Remove unnecessary XSS check introduced by #2451

* Remove test file of `isValidXss`
2020-01-20 09:20:33 -07:00
不才
ee47120a09 If this place is false, it will report an error, so you should delete the useless code. (#2458) 2019-12-25 13:00:15 -08:00
Michael Shin
03e6f4bf4c Fixing invalid agent issue (#1904) 2019-12-25 12:55:36 -08:00
ZhaoXC
dc4bc49673 fix: fix ignore set withCredentials false (#2582) 2019-12-08 23:52:45 -08:00
Alanscut
13c948e661
Remove 'includes' API, fix CI build failure (#2574)
* Remove 'includes' API, fix CI build failure
2019-12-09 10:28:37 +08:00
Angelos Chalaris
1a32ca0601 Remove dependency on is-buffer (#1816)
* Remove dependency on is-buffer from package.json
2019-11-17 22:53:27 -08:00
Yasu Flores
841466416b
Fix XSS logic that matched some valid urls (#2529)
* Fix XSS logic that matched some valid urls, e.g. "/one/?foo=bar", when it shouldn't match those
2019-11-07 18:39:24 -08:00
Felipe Martins
097948698a
Revert "Update Webpack + deps, remove now unnecessary polyfills" (#2479)
* Revert "Update Webpack + deps, remove now unnecessary polyfills (#2410)"

This reverts commit 189b34c45a.

* Fix build (#2496)

* Change syntax to see if build passes

* Test commit

* Test with node 10

* Test adding all browsers in travis

* remove other browsers when running on travis
2019-10-25 11:34:47 -03:00
Avindra Goolcharan
189b34c45a Update Webpack + deps, remove now unnecessary polyfills (#2410)
* Update deps

 * handles webpack 1 -> 4 migration

* remove promise helpers from dev files

assume `Promise` is available, or polyfilled by
the consumer

* Remove isArray util. `isArray` has good coverage, even
   in IE9. So lets remove the custom polyfill.

 https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/isArray

also resolves a few lint issues

* Remove trim util

String.protoype.trim has good coverage (including IE9)

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/Trim

Also, the http adapter already uses the native method.
2019-10-21 15:56:29 -03:00
Yasu Flores
29da6b24db Fix to prevent XSS, throw an error when the URL contains a JS script (#2464)
* Fixes issue where XSS scripts attacks were possible via the URL

* Fix error

* Move throwing error up

* Add specs and make regex cover more xss cases
2019-10-16 07:53:10 -03:00
IVLIU
6284abfa06 custom timeout prompt copy (#2275)
* style: ui

* feat: custom timeout txtx

* feat: custom timeout txtx
2019-10-15 22:29:16 -03:00
Wataru
19969b4fbd Fixing Vulnerability A Fortify Scan finds a critical Cross-Site Scrip… (#2451)
* Fixing Vulnerability A Fortify Scan finds a critical Cross-Site Scripting

* use var insted of const
2019-10-08 21:23:34 -03:00
Felipe Martins
85c9d4ffb0
fix: Fixing subdomain handling on no_proxy (#2442) 2019-09-28 20:51:20 -03:00
Jeremie Thomassey
00cd48027b Make redirection from HTTP to HTTPS work (#2426)
When calling an HTTP resource redirecting to a HTTPS one with a keepAlive agent. We get the following error:
```
TypeError [ERR_INVALID_PROTOCOL]: Protocol "https:" not supported. Expected "http:"
    at new ClientRequest (_http_client.js:119:11)
    at Object.request (https.js:281:10)
    at RedirectableRequest._performRequest (/Users/jthomassey/projects/ecom-shop-web/node_modules/follow-redirects/index.js:169:24)
    at RedirectableRequest._processResponse (/Users/jthomassey/projects/ecom-shop-web/node_modules/follow-redirects/index.js:260:10)
    at ClientRequest.RedirectableRequest._onNativeResponse (/Users/jthomassey/projects/ecom-shop-web/node_modules/follow-redirects/index.js:50:10)
    at Object.onceWrapper (events.js:277:13)
    at ClientRequest.emit (events.js:189:13)
    at HTTPParser.parserOnIncomingClient [as onIncoming] (_http_client.js:556:21)
    at HTTPParser.parserOnHeadersComplete (_http_common.js:109:17)
    at Socket.socketOnData (_http_client.js:442:20)
```

This can be tested here : 
```
const http = require('http');
const https = require('https');
const axios = require('axios');

axios.get('http://www.photobox.fr', { httpAgent: http.Agent({ keepAlive:true }), httpsAgent: https.Agent({ keepAlive:true }) })
  .then(response => {
    console.log(response);
    console.log(response.headers);
  })
  .catch(error => {
    console.log(error);
  });
```

Axios delegate the redirection to the follow-redirect package which accept an option `agents` for both http and https agent see : https://github.com/follow-redirects/follow-redirects#per-request-options
2019-09-26 09:33:49 -03:00