Skip to content

Backport allowAbsoluteUrls vuln fix to v0.x#6829

Merged
jasonsaayman merged 5 commits into
axios:v0.xfrom
thatguyinabeanie:backport-axios-vuln-fix
Mar 19, 2025
Merged

Backport allowAbsoluteUrls vuln fix to v0.x#6829
jasonsaayman merged 5 commits into
axios:v0.xfrom
thatguyinabeanie:backport-axios-vuln-fix

Conversation

@thatguyinabeanie

@thatguyinabeanie thatguyinabeanie commented Mar 13, 2025

Copy link
Copy Markdown

Describe your pull request here.

Backports fix for github/advisory-database#5356 on v1.x onto v0.x

Existing issue: #6824

@thatguyinabeanie

thatguyinabeanie commented Mar 13, 2025

Copy link
Copy Markdown
Author

running tests locally, 1 test fails

67 passing (4s)
  1 failing

  1) supports http with nodejs
       should support max content length:

      Uncaught AssertionError [ERR_ASSERTION]: 'Request failed with status code 400' == 'maxContentLength size of 2000 exceeded'
      + expected - actual

      -Request failed with status code 400
      +maxContentLength size of 2000 exceeded

      at Timeout._onTimeout (test/unit/adapters/http.js:

the same test fails on the v0.x branch

Comment thread lib/core/buildFullPath.js Outdated
if (baseURL && !isAbsoluteURL(requestedURL)) {
module.exports = function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
var isRelativeURL = !isAbsoluteURL(requestedURL);
if (baseURL && isRelativeURL || allowAbsoluteUrls === false) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the logic here is wrong. see #6833.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you kind sir for pointing that out 🙏🏽

@thatguyinabeanie

Copy link
Copy Markdown
Author

@jasonsaayman Please take a look when you get a chance.

Comment thread lib/core/buildFullPath.js Outdated
@jasonsaayman

Copy link
Copy Markdown
Member

@thatguyinabeanie you have pushed a compiled file, can you please remove that? thanks

Comment thread dist/axios.js Fixed
Comment thread dist/axios.js Fixed
@thatguyinabeanie

Copy link
Copy Markdown
Author

@thatguyinabeanie you have pushed a compiled file, can you please remove that? thanks

all set

@Abdullah-Schahin

Copy link
Copy Markdown

Hi @mhassan1 please review the changes if you get a chance.
Thanks @thatguyinabeanie for taking care of this

Comment thread lib/core/buildFullPath.js Outdated
@jasonsaayman jasonsaayman merged commit 02c3c69 into axios:v0.x Mar 19, 2025
@mhassan1

Copy link
Copy Markdown
Contributor

The typing changes are missing from this PR; see #6818.

@thatguyinabeanie thatguyinabeanie deleted the backport-axios-vuln-fix branch March 19, 2025 15:34
@jasonsaayman jasonsaayman self-assigned this Mar 20, 2025
@sgleisner

Copy link
Copy Markdown

Thanks, @thatguyinabeanie, for the fix, and @jasonsaayman and @mhassan1 for reviewing!

Is this scheduled for release soon, or should we wait for the typing changes to be merged first?

Also, I noticed that #6833 by @mhassan1 doesn’t include the strict equal comparison @jasonsaayman included in this PR. Is that intentional, or should we open an issue for it?

@thatguyinabeanie

Copy link
Copy Markdown
Author

@mhassan1 thanks for pointing that out!

@jasonsaayman i opened a new PR that adds the types #6849

@jasonsaayman

Copy link
Copy Markdown
Member

thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants