-
-
Notifications
You must be signed in to change notification settings - Fork 10.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixed FormData posting in browser environment by reverting #3785; #4640
Conversation
@@ -27,6 +27,10 @@ module.exports = function xhrAdapter(config) { | |||
} | |||
} | |||
|
|||
if (utils.isFormData(requestData) && utils.isStandardBrowserEnv()) { | |||
delete requestHeaders['Content-Type']; // Let the browser set it |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't this be done further down in order to use normalised headers?
Using this here would only catch the specific casing Content-Type
and not content-type
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Probably yes, but this PR only brings back the removed code and adds an additional environment check to fix the regression bug. Axios headers helper is far away from perfection, and it should be deeply refactored to be really caseless, not just locally.
Unfortunately, the PR #4215 where the headers helper is reworked is still not merged, so it would be better to keep it as it was for a while.
https://github.com/axios/axios/pull/4215/files#diff-e3e3dd5daf3f63345305a7397f39f6adce58f3ff9b987a96da808b060079958b
<h3>Snyk has created this PR to upgrade axios from 0.26.1 to 0.27.2.</h3> :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project. <hr/> - The recommended version is **3 versions** ahead of your current version. - The recommended version was released **a year ago**, on 2022-04-27. <details> <summary><b>Release notes</b></summary> <br/> <details> <summary>Package name: <b>axios</b></summary> <ul> <li> <b>0.27.2</b> - <a href="https://snyk.io/redirect/github/axios/axios/releases/tag/v0.27.2">2022-04-27</a></br><p>Fixes and Functionality:</p> <ul> <li>Fixed FormData posting in browser environment by reverting <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="878655062" data-permission-text="Title is private" data-url="axios/axios#3785" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/3785/hovercard" href="https://snyk.io/redirect/github/axios/axios/pull/3785">#3785</a> (<a href="https://snyk.io/redirect/github/axios/axios/pull/4640" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4640/hovercard">#4640</a>)</li> <li>Enhanced protocol parsing implementation (<a href="https://snyk.io/redirect/github/axios/axios/pull/4639" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4639/hovercard">#4639</a>)</li> <li>Fixed bundle size</li> </ul> </li> <li> <b>0.27.1</b> - <a href="https://snyk.io/redirect/github/axios/axios/releases/tag/v0.27.1">2022-04-26</a></br><h3>Fixes and Functionality:</h3> <ul> <li>Removed import of url module in browser build due to huge size overhead and builds being broken (<a href="https://snyk.io/redirect/github/axios/axios/pull/4594" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4594/hovercard">#4594</a>)</li> <li>Bumped follow-redirects to ^1.14.9 (<a href="https://snyk.io/redirect/github/axios/axios/pull/4615" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4615/hovercard">#4615</a>)</li> </ul> </li> <li> <b>0.27.0</b> - <a href="https://snyk.io/redirect/github/axios/axios/releases/tag/v0.27.0">2022-04-25</a></br><h3>Breaking changes:</h3> <ul> <li>New toFormData helper function that allows the implementor to pass an object and allow axios to convert it to FormData (<a href="https://snyk.io/redirect/github/axios/axios/pull/3757" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/3757/hovercard">#3757</a>)</li> <li>Removed functionality that removed the the <code>Content-Type</code> request header when passing FormData (<a href="https://snyk.io/redirect/github/axios/axios/pull/3785" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/3785/hovercard">#3785</a>)</li> <li><strong>(*)</strong> Refactored error handling implementing AxiosError as a constructor, this is a large change to error handling on the whole (<a href="https://snyk.io/redirect/github/axios/axios/pull/3645" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/3645/hovercard">#3645</a>)</li> <li>Separated responsibility for FormData instantiation between <code>transformRequest</code> and <code>toFormData</code> (<a href="https://snyk.io/redirect/github/axios/axios/pull/4470" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4470/hovercard">#4470</a>)</li> <li><strong>(*)</strong> Improved and fixed multiple issues with FormData support (<a href="https://snyk.io/redirect/github/axios/axios/pull/4448" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4448/hovercard">#4448</a>)</li> </ul> <h3>QOL and DevX improvements:</h3> <ul> <li>Added a multipart/form-data testing playground allowing contributors to debug changes easily (<a href="https://snyk.io/redirect/github/axios/axios/pull/4465" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4465/hovercard">#4465</a>)</li> </ul> <h3>Fixes and Functionality:</h3> <ul> <li>Refactored project file structure to avoid circular imports (<a href="https://snyk.io/redirect/github/axios/axios/pull/4516" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4516/hovercard">#4515</a>) & (<a href="https://snyk.io/redirect/github/axios/axios/pull/4516" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4516/hovercard">#4516</a>)</li> <li>Bumped follow-redirects to ^1.14.9 (<a href="https://snyk.io/redirect/github/axios/axios/pull/4562" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4562/hovercard">#4562</a>)</li> </ul> <h3>Internal and Tests:</h3> <ul> <li>Updated dev dependencies to latest version</li> </ul> <h3>Documentation:</h3> <ul> <li>Fixing incorrect link in changelog (<a href="https://snyk.io/redirect/github/axios/axios/pull/4551" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4551/hovercard">#4551</a>)</li> </ul> <h3>Notes:</h3> <ul> <li><strong>(*)</strong> Please read these pull requests before updating, these changes are very impactful and far reaching.</li> </ul> </li> <li> <b>0.26.1</b> - <a href="https://snyk.io/redirect/github/axios/axios/releases/tag/v0.26.1">2022-03-09</a></br><h3>Fixes and Functionality:</h3> <ul> <li>Refactored project file structure to avoid circular imports (<a href="https://snyk.io/redirect/github/axios/axios/pull/4220" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/4220/hovercard">#4220</a>)</li> </ul> </li> </ul> from <a href="https://snyk.io/redirect/github/axios/axios/releases">axios GitHub release notes</a> </details> </details> <hr/> **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.* For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiIyMDVhZWJmMC01NTE3LTQ2ZjQtODg0Zi0xYjEwZjdiOWU3YjgiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjIwNWFlYmYwLTU1MTctNDZmNC04ODRmLTFiMTBmN2I5ZTdiOCJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/satt/project/b89486be-ad07-4d6c-a51a-2fa8a25baa00?utm_source=github&utm_medium=referral&page=upgrade-pr) 🛠 [Adjust upgrade PR settings](https://app.snyk.io/org/satt/project/b89486be-ad07-4d6c-a51a-2fa8a25baa00/settings/integration?utm_source=github&utm_medium=referral&page=upgrade-pr) 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.snyk.io/org/satt/project/b89486be-ad07-4d6c-a51a-2fa8a25baa00/settings/integration?pkg=axios&utm_source=github&utm_medium=referral&page=upgrade-pr#auto-dep-upgrades) <!--- (snyk:metadata:{"prId":"205aebf0-5517-46f4-884f-1b10f7b9e7b8","prPublicId":"205aebf0-5517-46f4-884f-1b10f7b9e7b8","dependencies":[{"name":"axios","from":"0.26.1","to":"0.27.2"}],"packageManager":"npm","type":"auto","projectUrl":"https://app.snyk.io/org/satt/project/b89486be-ad07-4d6c-a51a-2fa8a25baa00?utm_source=github&utm_medium=referral&page=upgrade-pr","projectPublicId":"b89486be-ad07-4d6c-a51a-2fa8a25baa00","env":"prod","prType":"upgrade","vulns":[],"issuesToFix":[],"upgrade":[],"upgradeInfo":{"versionsDiff":3,"publishedDate":"2022-04-27T10:00:58.685Z"},"templateVariants":[],"hasFixes":false,"isMajorUpgrade":false,"isBreakingChange":false,"priorityScoreList":[]}) --->
Not sure why, but PR #3785 removed the code that deletes thecontent-type
header in case of FormData payload for xhr adapter (browser build); This breaks the FormData support for the browser.Update: now it removes the
content-type
header only for the standard browser environment. React native should keep the original header from the config.Closes #4631