Skip to content

fix: form data recursion#10726

Merged
jasonsaayman merged 9 commits intov1.xfrom
fix/form-data-recursion
Apr 15, 2026
Merged

fix: form data recursion#10726
jasonsaayman merged 9 commits intov1.xfrom
fix/form-data-recursion

Conversation

@jasonsaayman
Copy link
Copy Markdown
Member

@jasonsaayman jasonsaayman commented Apr 15, 2026

Summary by cubic

Adds a recursion depth guard to FormData and query params serialization to prevent call-stack overflows. Defaults to maxDepth: 100 (configurable, Infinity disables) and throws AxiosError with code ERR_FORM_DATA_DEPTH_EXCEEDED; docs, typings, and tests updated.

Description

  • Summary of changes
    • Add maxDepth to toFormData and AxiosURLSearchParams (default 100; Infinity disables).
    • Throw AxiosError with ERR_FORM_DATA_DEPTH_EXCEEDED when exceeded (instead of RangeError).
    • Expose error code on AxiosError at runtime and in typings (index.d.ts, index.d.cts).
    • Minor workflow/quoting cleanups.
  • Reasoning
    • Prevent call-stack overflows and hard crashes from deeply nested user input; provide a clear, catchable error.
  • Additional context
    • Applies to both form-data and query params; at-limit succeeds; circular refs still detected and reported separately.

Docs

  • README and EN/ES/FR/ZH docs updated to document formSerializer.maxDepth and paramsSerializer.maxDepth, with examples and security notes.
  • Clarified request config snippets and unified code examples.

Testing

  • Added unit tests:
    • Default limit throws; at-limit passes; custom limits and Infinity behave as expected.
    • Circular references still detected.
    • Params serialization via AxiosURLSearchParams enforces maxDepth.
  • Types validated by exposing ERR_FORM_DATA_DEPTH_EXCEEDED in index.d.ts and index.d.cts.

Written for commit de52db8. Summary will update on new commits.

@jasonsaayman jasonsaayman self-assigned this Apr 15, 2026
@jasonsaayman jasonsaayman added priority::medium A medium priority commit::fix The PR is related to a bugfix labels Apr 15, 2026
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3 issues found across 17 files

Confidence score: 4/5

  • This PR looks generally safe to merge, with issues that are mostly localized and straightforward to fix rather than broad runtime regressions.
  • The highest-impact item is in tests/unit/toFormData.test.js: nest(100) appears to trigger the default maxDepth: 100 guard, so the boundary test is off by one and likely to fail unless adjusted.
  • There is a public API consistency gap in lib/core/AxiosError.js versus typings: the new runtime error code should also be declared in index.d.ts to avoid TypeScript consumer mismatch.
  • Pay close attention to tests/unit/toFormData.test.js, lib/core/AxiosError.js, and docs/es/pages/advanced/multipart-form-data-format.md - boundary behavior, TS declaration parity, and docs option structure need alignment.
Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/es/pages/advanced/multipart-form-data-format.md">

<violation number="1" location="docs/es/pages/advanced/multipart-form-data-format.md:86">
P3: Move `maxDepth` out of the `indexes` sublist so it renders as a top-level `formSerializer` option.</violation>
</file>

<file name="tests/unit/toFormData.test.js">

<violation number="1" location="tests/unit/toFormData.test.js:137">
P2: This boundary case is off by one: `nest(100)` already hits the default `maxDepth: 100` guard, so the test will fail. Use one level less for the success case (or expect an error).</violation>
</file>

<file name="lib/core/AxiosError.js">

<violation number="1" location="lib/core/AxiosError.js:89">
P2: Add the new error code to the TypeScript declaration; the runtime now exposes a public constant that `index.d.ts` does not declare.</violation>
</file>

Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.

Comment thread tests/unit/toFormData.test.js
Comment thread lib/core/AxiosError.js
Comment thread docs/es/pages/advanced/multipart-form-data-format.md Outdated
@jasonsaayman
Copy link
Copy Markdown
Member Author

@cubic-dev-ai please review again

@cubic-dev-ai
Copy link
Copy Markdown
Contributor

cubic-dev-ai Bot commented Apr 15, 2026

@cubic-dev-ai please review again

@jasonsaayman I have started the AI code review. It will take a few minutes to complete.

afurm

This comment was marked as off-topic.

Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 19 files

Confidence score: 5/5

  • Low merge risk: this is a single low-severity documentation issue (3/10) with no direct runtime or functional regression indicated.
  • In docs/es/pages/advanced/multipart-form-data-format.md, the example should use a multipart request; otherwise formSerializer is ignored, which can mislead readers about correct usage.
  • Pay close attention to docs/es/pages/advanced/multipart-form-data-format.md - ensure the request type matches multipart behavior so the example reflects actual formSerializer handling.
Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/es/pages/advanced/multipart-form-data-format.md">

<violation number="1" location="docs/es/pages/advanced/multipart-form-data-format.md:90">
P3: Use a multipart request here; otherwise `formSerializer` is ignored and the example is misleading.</violation>
</file>

Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.

Comment thread docs/es/pages/advanced/multipart-form-data-format.md
@jasonsaayman jasonsaayman merged commit 85132ff into v1.x Apr 15, 2026
26 checks passed
@jasonsaayman jasonsaayman deleted the fix/form-data-recursion branch April 15, 2026 18:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

commit::fix The PR is related to a bugfix priority::medium A medium priority

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants