Skip to content

Fix to prevent XSS, throw an error when the URL contains a JS script #2464

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
felipewmartins merged 6 commits into from
Oct 16, 2019
Merged

Fix to prevent XSS, throw an error when the URL contains a JS script #2464

felipewmartins merged 6 commits into from
Oct 16, 2019

Conversation

@yasuf
Copy link
Collaborator

@yasuf yasuf commented Oct 14, 2019 •
edited
Loading

@yasuf yasuf changed the title XSS fix to throw errror when the URL contains a JS script Fix to prevent XSS, throw an error when the URL contains a JS script Oct 14, 2019
AleksueiR
AleksueiR reviewed Oct 14, 2019
View reviewed changes
@snoopysecurity
Copy link

snoopysecurity commented Oct 15, 2019 •
edited
Loading

Hey 👋 So the PR itself does amend the logic of isValidXss to throw an error and that makes sense. However, by looking at the logic of

axios/lib/helpers/isValidXss.js

Line 4 in 19969b4

var regex = RegExp('<script+.*>+.*<\/script>');
, It is very easy to bypass this validation by having a payload such as https://github.com/axios/axios?<svg/onload=alert(1)> or anything other than a script tag.

This isn't a huge problem since #2447 seems be not exploitable anyway. So this PR might be enough to stop Fortify reporting this as a vulnerability.

Hope this helps

@felipewmartins felipewmartins merged commit 29da6b2 into axios:master Oct 16, 2019
@etanxing
Copy link

etanxing commented Oct 21, 2019

Thanks guys, any plan for this release?

@felipewmartins
Copy link
Contributor

felipewmartins commented Oct 21, 2019

@yasuf This merge cause a error in the main build. Please are you can see? I need this to fix the #2479

@yasuf
Copy link
Collaborator Author

yasuf commented Oct 21, 2019 •
edited
Loading

what's the error? where can I see it?

edit: nevermind, found your PR

@felipewmartins
Copy link
Contributor

felipewmartins commented Oct 22, 2019

Hi @yasuf
This build
https://travis-ci.org/axios/axios/builds/598593005

@Alanscut Alanscut mentioned this pull request Oct 25, 2019
Merged
This was referenced Jan 7, 2020
Open
Open
Open
Closed
Merged
Closed
Open
Merged
Open
Merged
Merged
Merged
Merged
Closed
Merged
This was referenced Apr 3, 2020
Open
Open
Closed
Open
Closed
Merged
Closed
Open
Closed
Closed
Merged
Merged
Merged
Open
Open
Open
This was referenced Apr 13, 2020
Open
Open
Open
Closed
This was referenced Apr 21, 2020
Open
Open
Open
Open
Open
Open
This was referenced Apr 30, 2020
Open
Open
Merged
@axios axios locked and limited conversation to collaborators May 3, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

1 more reviewer

@AleksueiR AleksueiR AleksueiR left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@yasuf @snoopysecurity @etanxing @felipewmartins @JyothiYamajala @AleksueiR