From e24c4c8efa7bb73d8a388fb1d0aa7acd98064492 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 00:44:54 +0000 Subject: [PATCH 1/2] fix: apply audit fixes --- dist/index.js | 1795 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 1478 insertions(+), 317 deletions(-) diff --git a/dist/index.js b/dist/index.js index e3d47fa..46e9b66 100644 --- a/dist/index.js +++ b/dist/index.js @@ -8926,6 +8926,241 @@ exports.XMLReader = XMLReader; exports.ParseError = ParseError; +/***/ }), + +/***/ 9690: +/***/ (function(module, __unused_webpack_exports, __nccwpck_require__) { + +"use strict"; + +var __importDefault = (this && this.__importDefault) || function (mod) { + return (mod && mod.__esModule) ? mod : { "default": mod }; +}; +const events_1 = __nccwpck_require__(2361); +const debug_1 = __importDefault(__nccwpck_require__(8237)); +const promisify_1 = __importDefault(__nccwpck_require__(6570)); +const debug = debug_1.default('agent-base'); +function isAgent(v) { + return Boolean(v) && typeof v.addRequest === 'function'; +} +function isSecureEndpoint() { + const { stack } = new Error(); + if (typeof stack !== 'string') + return false; + return stack.split('\n').some(l => l.indexOf('(https.js:') !== -1 || l.indexOf('node:https:') !== -1); +} +function createAgent(callback, opts) { + return new createAgent.Agent(callback, opts); +} +(function (createAgent) { + /** + * Base `http.Agent` implementation. + * No pooling/keep-alive is implemented by default. + * + * @param {Function} callback + * @api public + */ + class Agent extends events_1.EventEmitter { + constructor(callback, _opts) { + super(); + let opts = _opts; + if (typeof callback === 'function') { + this.callback = callback; + } + else if (callback) { + opts = callback; + } + // Timeout for the socket to be returned from the callback + this.timeout = null; + if (opts && typeof opts.timeout === 'number') { + this.timeout = opts.timeout; + } + // These aren't actually used by `agent-base`, but are required + // for the TypeScript definition files in `@types/node` :/ + this.maxFreeSockets = 1; + this.maxSockets = 1; + this.maxTotalSockets = Infinity; + this.sockets = {}; + this.freeSockets = {}; + this.requests = {}; + this.options = {}; + } + get defaultPort() { + if (typeof this.explicitDefaultPort === 'number') { + return this.explicitDefaultPort; + } + return isSecureEndpoint() ? 443 : 80; + } + set defaultPort(v) { + this.explicitDefaultPort = v; + } + get protocol() { + if (typeof this.explicitProtocol === 'string') { + return this.explicitProtocol; + } + return isSecureEndpoint() ? 'https:' : 'http:'; + } + set protocol(v) { + this.explicitProtocol = v; + } + callback(req, opts, fn) { + throw new Error('"agent-base" has no default implementation, you must subclass and override `callback()`'); + } + /** + * Called by node-core's "_http_client.js" module when creating + * a new HTTP request with this Agent instance. + * + * @api public + */ + addRequest(req, _opts) { + const opts = Object.assign({}, _opts); + if (typeof opts.secureEndpoint !== 'boolean') { + opts.secureEndpoint = isSecureEndpoint(); + } + if (opts.host == null) { + opts.host = 'localhost'; + } + if (opts.port == null) { + opts.port = opts.secureEndpoint ? 443 : 80; + } + if (opts.protocol == null) { + opts.protocol = opts.secureEndpoint ? 'https:' : 'http:'; + } + if (opts.host && opts.path) { + // If both a `host` and `path` are specified then it's most + // likely the result of a `url.parse()` call... we need to + // remove the `path` portion so that `net.connect()` doesn't + // attempt to open that as a unix socket file. + delete opts.path; + } + delete opts.agent; + delete opts.hostname; + delete opts._defaultAgent; + delete opts.defaultPort; + delete opts.createConnection; + // Hint to use "Connection: close" + // XXX: non-documented `http` module API :( + req._last = true; + req.shouldKeepAlive = false; + let timedOut = false; + let timeoutId = null; + const timeoutMs = opts.timeout || this.timeout; + const onerror = (err) => { + if (req._hadError) + return; + req.emit('error', err); + // For Safety. Some additional errors might fire later on + // and we need to make sure we don't double-fire the error event. + req._hadError = true; + }; + const ontimeout = () => { + timeoutId = null; + timedOut = true; + const err = new Error(`A "socket" was not created for HTTP request before ${timeoutMs}ms`); + err.code = 'ETIMEOUT'; + onerror(err); + }; + const callbackError = (err) => { + if (timedOut) + return; + if (timeoutId !== null) { + clearTimeout(timeoutId); + timeoutId = null; + } + onerror(err); + }; + const onsocket = (socket) => { + if (timedOut) + return; + if (timeoutId != null) { + clearTimeout(timeoutId); + timeoutId = null; + } + if (isAgent(socket)) { + // `socket` is actually an `http.Agent` instance, so + // relinquish responsibility for this `req` to the Agent + // from here on + debug('Callback returned another Agent instance %o', socket.constructor.name); + socket.addRequest(req, opts); + return; + } + if (socket) { + socket.once('free', () => { + this.freeSocket(socket, opts); + }); + req.onSocket(socket); + return; + } + const err = new Error(`no Duplex stream was returned to agent-base for \`${req.method} ${req.path}\``); + onerror(err); + }; + if (typeof this.callback !== 'function') { + onerror(new Error('`callback` is not defined')); + return; + } + if (!this.promisifiedCallback) { + if (this.callback.length >= 3) { + debug('Converting legacy callback function to promise'); + this.promisifiedCallback = promisify_1.default(this.callback); + } + else { + this.promisifiedCallback = this.callback; + } + } + if (typeof timeoutMs === 'number' && timeoutMs > 0) { + timeoutId = setTimeout(ontimeout, timeoutMs); + } + if ('port' in opts && typeof opts.port !== 'number') { + opts.port = Number(opts.port); + } + try { + debug('Resolving socket for %o request: %o', opts.protocol, `${req.method} ${req.path}`); + Promise.resolve(this.promisifiedCallback(req, opts)).then(onsocket, callbackError); + } + catch (err) { + Promise.reject(err).catch(callbackError); + } + } + freeSocket(socket, opts) { + debug('Freeing socket %o %o', socket.constructor.name, opts); + socket.destroy(); + } + destroy() { + debug('Destroying agent %o', this.constructor.name); + } + } + createAgent.Agent = Agent; + // So that `instanceof` works correctly + createAgent.prototype = createAgent.Agent.prototype; +})(createAgent || (createAgent = {})); +module.exports = createAgent; +//# sourceMappingURL=index.js.map + +/***/ }), + +/***/ 6570: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +Object.defineProperty(exports, "__esModule", ({ value: true })); +function promisify(fn) { + return function (req, opts) { + return new Promise((resolve, reject) => { + fn.call(this, req, opts, (err, rtn) => { + if (err) { + reject(err); + } + else { + resolve(rtn); + } + }); + }); + }; +} +exports["default"] = promisify; +//# sourceMappingURL=promisify.js.map + /***/ }), /***/ 4812: @@ -12975,6 +13210,284 @@ var bind = __nccwpck_require__(8334); module.exports = bind.call(call, $hasOwn); +/***/ }), + +/***/ 5098: +/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) { + +"use strict"; + +var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) { + function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); } + return new (P || (P = Promise))(function (resolve, reject) { + function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } } + function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } } + function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); } + step((generator = generator.apply(thisArg, _arguments || [])).next()); + }); +}; +var __importDefault = (this && this.__importDefault) || function (mod) { + return (mod && mod.__esModule) ? mod : { "default": mod }; +}; +Object.defineProperty(exports, "__esModule", ({ value: true })); +const net_1 = __importDefault(__nccwpck_require__(1808)); +const tls_1 = __importDefault(__nccwpck_require__(4404)); +const url_1 = __importDefault(__nccwpck_require__(7310)); +const assert_1 = __importDefault(__nccwpck_require__(9491)); +const debug_1 = __importDefault(__nccwpck_require__(8237)); +const agent_base_1 = __nccwpck_require__(9690); +const parse_proxy_response_1 = __importDefault(__nccwpck_require__(595)); +const debug = debug_1.default('https-proxy-agent:agent'); +/** + * The `HttpsProxyAgent` implements an HTTP Agent subclass that connects to + * the specified "HTTP(s) proxy server" in order to proxy HTTPS requests. + * + * Outgoing HTTP requests are first tunneled through the proxy server using the + * `CONNECT` HTTP request method to establish a connection to the proxy server, + * and then the proxy server connects to the destination target and issues the + * HTTP request from the proxy server. + * + * `https:` requests have their socket connection upgraded to TLS once + * the connection to the proxy server has been established. + * + * @api public + */ +class HttpsProxyAgent extends agent_base_1.Agent { + constructor(_opts) { + let opts; + if (typeof _opts === 'string') { + opts = url_1.default.parse(_opts); + } + else { + opts = _opts; + } + if (!opts) { + throw new Error('an HTTP(S) proxy server `host` and `port` must be specified!'); + } + debug('creating new HttpsProxyAgent instance: %o', opts); + super(opts); + const proxy = Object.assign({}, opts); + // If `true`, then connect to the proxy server over TLS. + // Defaults to `false`. + this.secureProxy = opts.secureProxy || isHTTPS(proxy.protocol); + // Prefer `hostname` over `host`, and set the `port` if needed. + proxy.host = proxy.hostname || proxy.host; + if (typeof proxy.port === 'string') { + proxy.port = parseInt(proxy.port, 10); + } + if (!proxy.port && proxy.host) { + proxy.port = this.secureProxy ? 443 : 80; + } + // ALPN is supported by Node.js >= v5. + // attempt to negotiate http/1.1 for proxy servers that support http/2 + if (this.secureProxy && !('ALPNProtocols' in proxy)) { + proxy.ALPNProtocols = ['http 1.1']; + } + if (proxy.host && proxy.path) { + // If both a `host` and `path` are specified then it's most likely + // the result of a `url.parse()` call... we need to remove the + // `path` portion so that `net.connect()` doesn't attempt to open + // that as a Unix socket file. + delete proxy.path; + delete proxy.pathname; + } + this.proxy = proxy; + } + /** + * Called when the node-core HTTP client library is creating a + * new HTTP request. + * + * @api protected + */ + callback(req, opts) { + return __awaiter(this, void 0, void 0, function* () { + const { proxy, secureProxy } = this; + // Create a socket connection to the proxy server. + let socket; + if (secureProxy) { + debug('Creating `tls.Socket`: %o', proxy); + socket = tls_1.default.connect(proxy); + } + else { + debug('Creating `net.Socket`: %o', proxy); + socket = net_1.default.connect(proxy); + } + const headers = Object.assign({}, proxy.headers); + const hostname = `${opts.host}:${opts.port}`; + let payload = `CONNECT ${hostname} HTTP/1.1\r\n`; + // Inject the `Proxy-Authorization` header if necessary. + if (proxy.auth) { + headers['Proxy-Authorization'] = `Basic ${Buffer.from(proxy.auth).toString('base64')}`; + } + // The `Host` header should only include the port + // number when it is not the default port. + let { host, port, secureEndpoint } = opts; + if (!isDefaultPort(port, secureEndpoint)) { + host += `:${port}`; + } + headers.Host = host; + headers.Connection = 'close'; + for (const name of Object.keys(headers)) { + payload += `${name}: ${headers[name]}\r\n`; + } + const proxyResponsePromise = parse_proxy_response_1.default(socket); + socket.write(`${payload}\r\n`); + const { statusCode, buffered } = yield proxyResponsePromise; + if (statusCode === 200) { + req.once('socket', resume); + if (opts.secureEndpoint) { + // The proxy is connecting to a TLS server, so upgrade + // this socket connection to a TLS connection. + debug('Upgrading socket connection to TLS'); + const servername = opts.servername || opts.host; + return tls_1.default.connect(Object.assign(Object.assign({}, omit(opts, 'host', 'hostname', 'path', 'port')), { socket, + servername })); + } + return socket; + } + // Some other status code that's not 200... need to re-play the HTTP + // header "data" events onto the socket once the HTTP machinery is + // attached so that the node core `http` can parse and handle the + // error status code. + // Close the original socket, and a new "fake" socket is returned + // instead, so that the proxy doesn't get the HTTP request + // written to it (which may contain `Authorization` headers or other + // sensitive data). + // + // See: https://hackerone.com/reports/541502 + socket.destroy(); + const fakeSocket = new net_1.default.Socket({ writable: false }); + fakeSocket.readable = true; + // Need to wait for the "socket" event to re-play the "data" events. + req.once('socket', (s) => { + debug('replaying proxy buffer for failed request'); + assert_1.default(s.listenerCount('data') > 0); + // Replay the "buffered" Buffer onto the fake `socket`, since at + // this point the HTTP module machinery has been hooked up for + // the user. + s.push(buffered); + s.push(null); + }); + return fakeSocket; + }); + } +} +exports["default"] = HttpsProxyAgent; +function resume(socket) { + socket.resume(); +} +function isDefaultPort(port, secure) { + return Boolean((!secure && port === 80) || (secure && port === 443)); +} +function isHTTPS(protocol) { + return typeof protocol === 'string' ? /^https:?$/i.test(protocol) : false; +} +function omit(obj, ...keys) { + const ret = {}; + let key; + for (key in obj) { + if (!keys.includes(key)) { + ret[key] = obj[key]; + } + } + return ret; +} +//# sourceMappingURL=agent.js.map + +/***/ }), + +/***/ 7219: +/***/ (function(module, __unused_webpack_exports, __nccwpck_require__) { + +"use strict"; + +var __importDefault = (this && this.__importDefault) || function (mod) { + return (mod && mod.__esModule) ? mod : { "default": mod }; +}; +const agent_1 = __importDefault(__nccwpck_require__(5098)); +function createHttpsProxyAgent(opts) { + return new agent_1.default(opts); +} +(function (createHttpsProxyAgent) { + createHttpsProxyAgent.HttpsProxyAgent = agent_1.default; + createHttpsProxyAgent.prototype = agent_1.default.prototype; +})(createHttpsProxyAgent || (createHttpsProxyAgent = {})); +module.exports = createHttpsProxyAgent; +//# sourceMappingURL=index.js.map + +/***/ }), + +/***/ 595: +/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) { + +"use strict"; + +var __importDefault = (this && this.__importDefault) || function (mod) { + return (mod && mod.__esModule) ? mod : { "default": mod }; +}; +Object.defineProperty(exports, "__esModule", ({ value: true })); +const debug_1 = __importDefault(__nccwpck_require__(8237)); +const debug = debug_1.default('https-proxy-agent:parse-proxy-response'); +function parseProxyResponse(socket) { + return new Promise((resolve, reject) => { + // we need to buffer any HTTP traffic that happens with the proxy before we get + // the CONNECT response, so that if the response is anything other than an "200" + // response code, then we can re-play the "data" events on the socket once the + // HTTP parser is hooked up... + let buffersLength = 0; + const buffers = []; + function read() { + const b = socket.read(); + if (b) + ondata(b); + else + socket.once('readable', read); + } + function cleanup() { + socket.removeListener('end', onend); + socket.removeListener('error', onerror); + socket.removeListener('close', onclose); + socket.removeListener('readable', read); + } + function onclose(err) { + debug('onclose had error %o', err); + } + function onend() { + debug('onend'); + } + function onerror(err) { + cleanup(); + debug('onerror %o', err); + reject(err); + } + function ondata(b) { + buffers.push(b); + buffersLength += b.length; + const buffered = Buffer.concat(buffers, buffersLength); + const endOfHeaders = buffered.indexOf('\r\n\r\n'); + if (endOfHeaders === -1) { + // keep buffering + debug('have not received end of HTTP headers yet...'); + read(); + return; + } + const firstLine = buffered.toString('ascii', 0, buffered.indexOf('\r\n')); + const statusCode = +firstLine.split(' ')[1]; + debug('got proxy server response: %o', firstLine); + resolve({ + statusCode, + buffered + }); + } + socket.on('error', onerror); + socket.on('close', onclose); + socket.on('end', onend); + read(); + }); +} +exports["default"] = parseProxyResponse; +//# sourceMappingURL=parse-proxy-response.js.map + /***/ }), /***/ 9775: @@ -14013,7 +14526,7 @@ module.exports = Comparator const parseOptions = __nccwpck_require__(785) const { safeRe: re, t } = __nccwpck_require__(9523) -const cmp = __nccwpck_require__(5098) +const cmp = __nccwpck_require__(4359) const debug = __nccwpck_require__(427) const SemVer = __nccwpck_require__(8088) const Range = __nccwpck_require__(9828) @@ -14980,7 +15493,7 @@ module.exports = clean /***/ }), -/***/ 5098: +/***/ 4359: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { "use strict"; @@ -15576,7 +16089,7 @@ const eq = __nccwpck_require__(1898) const neq = __nccwpck_require__(6017) const gte = __nccwpck_require__(5522) const lte = __nccwpck_require__(7520) -const cmp = __nccwpck_require__(5098) +const cmp = __nccwpck_require__(4359) const coerce = __nccwpck_require__(3466) const truncate = __nccwpck_require__(5937) const Comparator = __nccwpck_require__(1532) @@ -22448,12 +22961,13 @@ module.exports = require("zlib"); /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { "use strict"; -/*! Axios v1.16.0 Copyright (c) 2026 Matt Zabriskie and contributors */ +/*! Axios v1.18.1 Copyright (c) 2026 Matt Zabriskie and contributors */ var FormData$1 = __nccwpck_require__(4334); var crypto = __nccwpck_require__(6113); var url = __nccwpck_require__(7310); +var HttpsProxyAgent = __nccwpck_require__(7219); var http = __nccwpck_require__(3685); var https = __nccwpck_require__(5687); var http2 = __nccwpck_require__(5158); @@ -22489,6 +23003,52 @@ const { iterator, toStringTag } = Symbol; + +/* Creating a function that will check if an object has a property. */ +const hasOwnProperty = (({ + hasOwnProperty +}) => (obj, prop) => hasOwnProperty.call(obj, prop))(Object.prototype); + +/** + * Walk the prototype chain (excluding the shared Object.prototype) looking for + * an own `prop`. This distinguishes genuine own/inherited members — including + * class accessors and template prototypes — from members injected via + * Object.prototype pollution (e.g. `Object.prototype.username = '...'`), which + * live on Object.prototype itself and are therefore never matched. + * + * @param {*} thing The value whose chain to inspect + * @param {string|symbol} prop The property key to look for + * + * @returns {boolean} True when `prop` is owned below Object.prototype + */ +const hasOwnInPrototypeChain = (thing, prop) => { + let obj = thing; + const seen = []; + while (obj != null && obj !== Object.prototype) { + if (seen.indexOf(obj) !== -1) { + return false; + } + seen.push(obj); + if (hasOwnProperty(obj, prop)) { + return true; + } + obj = getPrototypeOf(obj); + } + return false; +}; + +/** + * Read `obj[prop]` only when it is safe from Object.prototype pollution. Own + * properties and members inherited from a non-Object.prototype source (a class + * instance or template object) are honored; a value reachable only through a + * polluted Object.prototype is ignored and `undefined` is returned. + * + * @param {*} obj The source object + * @param {string|symbol} prop The property key to read + * + * @returns {*} The resolved value, or undefined when unsafe/absent + */ +const getSafeProp = (obj, prop) => obj != null && hasOwnInPrototypeChain(obj, prop) ? obj[prop] : undefined; const kindOf = (cache => thing => { const str = toString.call(thing); return cache[str] || (cache[str] = str.slice(8, -1).toLowerCase()); @@ -22607,11 +23167,15 @@ const isBoolean = thing => thing === true || thing === false; * @returns {boolean} True if value is a plain Object, otherwise false */ const isPlainObject = val => { - if (kindOf(val) !== 'object') { + if (!isObject(val)) { return false; } const prototype = getPrototypeOf(val); - return (prototype === null || prototype === Object.prototype || Object.getPrototypeOf(prototype) === null) && !(toStringTag in val) && !(iterator in val); + return (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) && + // Treat any genuine (non-Object.prototype-polluted) Symbol.toStringTag or + // Symbol.iterator as evidence the value is a tagged/iterable type rather + // than a plain object, while ignoring keys injected onto Object.prototype. + !hasOwnInPrototypeChain(val, toStringTag) && !hasOwnInPrototypeChain(val, iterator); }; /** @@ -22866,7 +23430,10 @@ function merge(...objs) { if (key === '__proto__' || key === 'constructor' || key === 'prototype') { return; } - const targetKey = caseless && findKey(result, key) || key; + + // findKey lowercases the key, so caseless lookup only applies to strings — + // symbol keys are identity-matched. + const targetKey = caseless && typeof key === 'string' && findKey(result, key) || key; // Read via own-prop only — a bare `result[targetKey]` walks the prototype // chain, so a polluted Object.prototype value could surface here and get // copied into the merged result. @@ -22882,7 +23449,21 @@ function merge(...objs) { } }; for (let i = 0, l = objs.length; i < l; i++) { - objs[i] && forEach(objs[i], assignValue); + const source = objs[i]; + if (!source || isBuffer(source)) { + continue; + } + forEach(source, assignValue); + if (typeof source !== 'object' || isArray(source)) { + continue; + } + const symbols = Object.getOwnPropertySymbols(source); + for (let j = 0; j < symbols.length; j++) { + const symbol = symbols[j]; + if (propertyIsEnumerable.call(source, symbol)) { + assignValue(source[symbol], symbol); + } + } } return result; } @@ -23094,11 +23675,9 @@ const toCamelCase = str => { return p1.toUpperCase() + p2; }); }; - -/* Creating a function that will check if an object has a property. */ -const hasOwnProperty = (({ - hasOwnProperty -}) => (obj, prop) => hasOwnProperty.call(obj, prop))(Object.prototype); +const { + propertyIsEnumerable +} = Object.prototype; /** * Determine if a value is a RegExp object @@ -23187,10 +23766,10 @@ function isSpecCompliantForm(thing) { * @returns {Object} The JSON-compatible object. */ const toJSONObject = obj => { - const stack = new Array(10); - const visit = (source, i) => { + const visited = new WeakSet(); + const visit = source => { if (isObject(source)) { - if (stack.indexOf(source) >= 0) { + if (visited.has(source)) { return; } @@ -23199,19 +23778,20 @@ const toJSONObject = obj => { return source; } if (!('toJSON' in source)) { - stack[i] = source; + // add-on descent / delete-on-ascent: preserves path semantics, so DAG nodes serialise at every occurrence (see #7230). + visited.add(source); const target = isArray(source) ? [] : {}; forEach(source, (value, key) => { - const reducedValue = visit(value, i + 1); + const reducedValue = visit(value); !isUndefined(reducedValue) && (target[key] = reducedValue); }); - stack[i] = undefined; + visited.delete(source); return target; } } return source; }; - return visit(obj, 0); + return visit(obj); }; /** @@ -23272,6 +23852,19 @@ const asap = typeof queueMicrotask !== 'undefined' ? queueMicrotask.bind(_global // ********************* const isIterable = thing => thing != null && isFunction$1(thing[iterator]); + +/** + * Determine if a value is iterable via an iterator that is NOT sourced solely + * from a polluted Object.prototype. Use this instead of `isIterable` whenever + * the iterable comes from untrusted input (e.g. user-supplied header sources), + * so `Object.prototype[Symbol.iterator] = ...` cannot turn an ordinary object + * into an attacker-controlled entries iterator. + * + * @param {*} thing The value to test + * + * @returns {boolean} True if value has a non-polluted iterator + */ +const isSafeIterable = thing => thing != null && hasOwnInPrototypeChain(thing, iterator) && isIterable(thing); var utils$1 = { isArray, isArrayBuffer, @@ -23317,6 +23910,8 @@ var utils$1 = { hasOwnProperty, hasOwnProp: hasOwnProperty, // an alias to avoid ESLint no-prototype-builtins detection + hasOwnInPrototypeChain, + getSafeProp, reduceDescriptors, freezeMethods, toObjectSet, @@ -23332,7 +23927,8 @@ var utils$1 = { isThenable, setImmediate: _setImmediate, asap, - isIterable + isIterable, + isSafeIterable }; // RawAxiosHeaders whose duplicates are ignored by node @@ -23378,8 +23974,6 @@ var parseHeaders = rawHeaders => { return parsed; }; -const $internals = Symbol('internals'); -const INVALID_HEADER_VALUE_CHARS_RE = /[^\x09\x20-\x7E\x80-\xFF]/g; function trimSPorHTAB(str) { let start = 0; let end = str.length; @@ -23399,12 +23993,32 @@ function trimSPorHTAB(str) { } return start === 0 && end === str.length ? str : str.slice(start, end); } + +// The control-code ranges are intentional: header sanitization strips C0/DEL bytes. +// eslint-disable-next-line no-control-regex +const INVALID_UNICODE_HEADER_VALUE_CHARS = new RegExp('[\\u0000-\\u0008\\u000a-\\u001f\\u007f]+', 'g'); +// eslint-disable-next-line no-control-regex +const INVALID_BYTE_STRING_HEADER_VALUE_CHARS = new RegExp('[^\\u0009\\u0020-\\u007e\\u0080-\\u00ff]+', 'g'); +function sanitizeValue(value, invalidChars) { + if (utils$1.isArray(value)) { + return value.map(item => sanitizeValue(item, invalidChars)); + } + return trimSPorHTAB(String(value).replace(invalidChars, '')); +} +const sanitizeHeaderValue = value => sanitizeValue(value, INVALID_UNICODE_HEADER_VALUE_CHARS); +const sanitizeByteStringHeaderValue = value => sanitizeValue(value, INVALID_BYTE_STRING_HEADER_VALUE_CHARS); +function toByteStringHeaderObject(headers) { + const byteStringHeaders = Object.create(null); + utils$1.forEach(headers.toJSON(), (value, header) => { + byteStringHeaders[header] = sanitizeByteStringHeaderValue(value); + }); + return byteStringHeaders; +} + +const $internals = Symbol('internals'); function normalizeHeader(header) { return header && String(header).trim().toLowerCase(); } -function sanitizeHeaderValue(str) { - return trimSPorHTAB(str.replace(INVALID_HEADER_VALUE_CHARS_RE, '')); -} function normalizeValue(value) { if (value === false || value == null) { return value; @@ -23464,7 +24078,7 @@ class AxiosHeaders { function setHeader(_value, _header, _rewrite) { const lHeader = normalizeHeader(_header); if (!lHeader) { - throw new Error('header name must be a non-empty string'); + return; } const key = utils$1.findKey(self, lHeader); if (!key || self[key] === undefined || _rewrite === true || _rewrite === undefined && self[key] !== false) { @@ -23476,15 +24090,21 @@ class AxiosHeaders { setHeaders(header, valueOrRewrite); } else if (utils$1.isString(header) && (header = header.trim()) && !isValidHeaderName(header)) { setHeaders(parseHeaders(header), valueOrRewrite); - } else if (utils$1.isObject(header) && utils$1.isIterable(header)) { - let obj = {}, + } else if (utils$1.isObject(header) && utils$1.isSafeIterable(header)) { + let obj = Object.create(null), dest, key; for (const entry of header) { if (!utils$1.isArray(entry)) { - throw TypeError('Object iterator must return a key-value pair'); + throw new TypeError('Object iterator must return a key-value pair'); + } + key = entry[0]; + if (utils$1.hasOwnProp(obj, key)) { + dest = obj[key]; + obj[key] = utils$1.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]]; + } else { + obj[key] = entry[1]; } - obj[key = entry[0]] = (dest = obj[key]) ? utils$1.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]] : entry[1]; } setHeaders(obj, valueOrRewrite); } else { @@ -23696,7 +24316,19 @@ function redactConfig(config, redactKeys) { class AxiosError extends Error { static from(error, code, config, request, response, customProps) { const axiosError = new AxiosError(error.message, code || error.code, config, request, response); - axiosError.cause = error; + // Match native `Error` `cause` semantics: non-enumerable. The wrapped + // error often carries circular internals (sockets, requests, agents), so + // an enumerable `cause` makes structured loggers (pino/winston) and any + // own-property walk throw "Converting circular structure to JSON". + // Regression from #6982; see #7205. `__proto__: null` mirrors the + // `message` descriptor below (prototype-pollution-safe descriptor). + Object.defineProperty(axiosError, 'cause', { + __proto__: null, + value: error, + writable: true, + enumerable: false, + configurable: true + }); axiosError.name = error.name; // Preserve status from the original error if not already set from response @@ -23787,6 +24419,10 @@ AxiosError.ERR_NOT_SUPPORT = 'ERR_NOT_SUPPORT'; AxiosError.ERR_INVALID_URL = 'ERR_INVALID_URL'; AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = 'ERR_FORM_DATA_DEPTH_EXCEEDED'; +// Default nesting limit shared with the inverse transform (formDataToJSON) so +// the FormData <-> JSON round-trip stays symmetric. +const DEFAULT_FORM_DATA_MAX_DEPTH = 100; + /** * Determines if the given thing is a array or js object. * @@ -23887,8 +24523,9 @@ function toFormData(obj, formData, options) { const dots = options.dots; const indexes = options.indexes; const _Blob = options.Blob || typeof Blob !== 'undefined' && Blob; - const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth; + const maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth; const useBlob = _Blob && utils$1.isSpecCompliantForm(formData); + const stack = []; if (!utils$1.isFunction(visitor)) { throw new TypeError('visitor must be a function'); } @@ -23904,10 +24541,38 @@ function toFormData(obj, formData, options) { throw new AxiosError('Blob is not supported. Use a Buffer instead.'); } if (utils$1.isArrayBuffer(value) || utils$1.isTypedArray(value)) { - return useBlob && typeof Blob === 'function' ? new Blob([value]) : Buffer.from(value); + if (useBlob && typeof _Blob === 'function') { + return new _Blob([value]); + } + if (typeof Buffer !== 'undefined') { + return Buffer.from(value); + } + throw new AxiosError('Blob is not supported. Use a Buffer instead.', AxiosError.ERR_NOT_SUPPORT); } return value; } + function throwIfMaxDepthExceeded(depth) { + if (depth > maxDepth) { + throw new AxiosError('Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED); + } + } + function stringifyWithDepthLimit(value, depth) { + if (maxDepth === Infinity) { + return JSON.stringify(value); + } + const ancestors = []; + return JSON.stringify(value, function limitDepth(_key, currentValue) { + if (!utils$1.isObject(currentValue)) { + return currentValue; + } + while (ancestors.length && ancestors[ancestors.length - 1] !== this) { + ancestors.pop(); + } + ancestors.push(currentValue); + throwIfMaxDepthExceeded(depth + ancestors.length - 1); + return currentValue; + }); + } /** * Default visitor. @@ -23930,7 +24595,7 @@ function toFormData(obj, formData, options) { // eslint-disable-next-line no-param-reassign key = metaTokens ? key : key.slice(0, -2); // eslint-disable-next-line no-param-reassign - value = JSON.stringify(value); + value = stringifyWithDepthLimit(value, 1); } else if (utils$1.isArray(value) && isFlatArray(value) || (utils$1.isFileList(value) || utils$1.endsWith(key, '[]')) && (arr = utils$1.toArray(value))) { // eslint-disable-next-line no-param-reassign key = removeBrackets(key); @@ -23948,7 +24613,6 @@ function toFormData(obj, formData, options) { formData.append(renderKey(path, key, dots), convertValue(value)); return false; } - const stack = []; const exposedHelpers = Object.assign(predicates, { defaultVisitor, convertValue, @@ -23956,11 +24620,9 @@ function toFormData(obj, formData, options) { }); function build(value, path, depth = 0) { if (utils$1.isUndefined(value)) return; - if (depth > maxDepth) { - throw new AxiosError('Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED); - } + throwIfMaxDepthExceeded(depth); if (stack.indexOf(value) !== -1) { - throw Error('Circular reference detected in ' + path.join('.')); + throw new Error('Circular reference detected in ' + path.join('.')); } stack.push(value); utils$1.forEach(value, function each(el, key) { @@ -24017,9 +24679,7 @@ prototype.append = function append(name, value) { this._pairs.push([name, value]); }; prototype.toString = function toString(encoder) { - const _encode = encoder ? function (value) { - return encoder.call(this, value, encode$1); - } : encode$1; + const _encode = encoder ? value => encoder.call(this, value, encode$1) : encode$1; return this._pairs.map(function each(pair) { return _encode(pair[0]) + '=' + _encode(pair[1]); }, '').join('&'); @@ -24050,11 +24710,16 @@ function buildURL(url, params, options) { if (!params) { return url; } - const _encode = options && options.encode || encode; + url = url || ''; const _options = utils$1.isFunction(options) ? { serialize: options } : options; - const serializeFn = _options && _options.serialize; + + // Read serializer options pollution-safely: own properties and methods on a + // class/template prototype are honored, but values injected onto a polluted + // Object.prototype are ignored. + const _encode = utils$1.getSafeProp(_options, 'encode') || encode; + const serializeFn = utils$1.getSafeProp(_options, 'serialize'); let serializedParams; if (serializeFn) { serializedParams = serializeFn(params, _options); @@ -24142,7 +24807,9 @@ var transitionalDefaults = { silentJSONParsing: true, forcedJSONParsing: true, clarifyTimeoutError: false, - legacyInterceptorReqResOrdering: true + legacyInterceptorReqResOrdering: true, + advertiseZstdAcceptEncoding: false, + validateStatusUndefinedResolves: true }; var URLSearchParams = url.URLSearchParams; @@ -24243,6 +24910,13 @@ function toURLEncodedForm(data, options) { }); } +const MAX_DEPTH = DEFAULT_FORM_DATA_MAX_DEPTH; +function throwIfDepthExceeded(index) { + if (index > MAX_DEPTH) { + throw new AxiosError('FormData field is too deeply nested (' + index + ' levels). Max depth: ' + MAX_DEPTH, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED); + } +} + /** * It takes a string like `foo[x][y][z]` and returns an array like `['foo', 'x', 'y', 'z'] * @@ -24255,9 +24929,14 @@ function parsePropPath(name) { // foo.x.y.z // foo-x-y-z // foo x y z - return utils$1.matchAll(/\w+|\[(\w*)]/g, name).map(match => { - return match[0] === '[]' ? '' : match[1] || match[0]; - }); + const path = []; + const pattern = /\w+|\[(\w*)]/g; + let match; + while ((match = pattern.exec(name)) !== null) { + throwIfDepthExceeded(path.length); + path.push(match[0] === '[]' ? '' : match[1] || match[0]); + } + return path; } /** @@ -24289,6 +24968,7 @@ function arrayToObject(arr) { */ function formDataToJSON(formData) { function buildPath(path, value, target, index) { + throwIfDepthExceeded(index); let name = path[index++]; if (name === '__proto__') return true; const isNumericKey = Number.isFinite(+name); @@ -24302,7 +24982,7 @@ function formDataToJSON(formData) { } return !isNumericKey; } - if (!target[name] || !utils$1.isObject(target[name])) { + if (!utils$1.hasOwnProp(target, name) || !utils$1.isObject(target[name])) { target[name] = []; } const result = buildPath(path, value, target[name], index); @@ -24529,6 +25209,24 @@ function combineURLs(baseURL, relativeURL) { return relativeURL ? baseURL.replace(/\/?\/$/, '') + '/' + relativeURL.replace(/^\/+/, '') : baseURL; } +const malformedHttpProtocol = /^https?:(?!\/\/)/i; +const httpProtocolControlCharacters = /[\t\n\r]/g; +function stripLeadingC0ControlOrSpace(url) { + let i = 0; + while (i < url.length && url.charCodeAt(i) <= 0x20) { + i++; + } + return url.slice(i); +} +function normalizeURLForProtocolCheck(url) { + return stripLeadingC0ControlOrSpace(url).replace(httpProtocolControlCharacters, ''); +} +function assertValidHttpProtocolURL(url, config) { + if (typeof url === 'string' && malformedHttpProtocol.test(normalizeURLForProtocolCheck(url))) { + throw new AxiosError('Invalid URL: missing "//" after protocol', AxiosError.ERR_INVALID_URL, config); + } +} + /** * Creates a new URL by combining the baseURL with the requestedURL, * only when the requestedURL is not already an absolute URL. @@ -24539,9 +25237,11 @@ function combineURLs(baseURL, relativeURL) { * * @returns {string} The combined full path */ -function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) { +function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls, config) { + assertValidHttpProtocolURL(requestedURL, config); let isRelativeUrl = !isAbsoluteURL(requestedURL); if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) { + assertValidHttpProtocolURL(baseURL, config); return combineURLs(baseURL, requestedURL); } return requestedURL; @@ -24643,14 +25343,16 @@ function getEnv(key) { return process.env[key.toLowerCase()] || process.env[key.toUpperCase()] || ''; } -const VERSION = "1.16.0"; +const VERSION = "1.18.1"; function parseProtocol(url) { const match = /^([-+\w]{1,25}):(?:\/\/)?/.exec(url); return match && match[1] || ''; } -const DATA_URL_PATTERN = /^(?:([^;]+);)?(?:[^;]+;)?(base64|),([\s\S]*)$/; +// RFC 2397: data:[][;base64], +// mediatype = type/subtype followed by optional ;name=value parameters +const DATA_URL_PATTERN = /^([^,;]+\/[^,;]+)?((?:;[^,;=]+=[^,;]+)*)(;base64)?,([\s\S]*)$/; /** * Parse data uri to a Buffer or Blob @@ -24674,10 +25376,20 @@ function fromDataURI(uri, asBlob, options) { if (!match) { throw new AxiosError('Invalid URL', AxiosError.ERR_INVALID_URL); } - const mime = match[1]; - const isBase64 = match[2]; - const body = match[3]; - const buffer = Buffer.from(decodeURIComponent(body), isBase64 ? 'base64' : 'utf8'); + const type = match[1]; + const params = match[2]; + const encoding = match[3] ? 'base64' : 'utf8'; + const body = match[4]; + + // RFC 2397 section 3: default mediatype is text/plain;charset=US-ASCII + // Bare `data:,` leaves mime undefined; Blob normalises that to "" per spec. + let mime = ''; + if (type) { + mime = params ? type + params : type; + } else if (params) { + mime = 'text/plain' + params; + } + const buffer = encoding === 'base64' ? Buffer.from(body, 'base64') : Buffer.from(decodeURIComponent(body), encoding); if (asBlob) { if (!_Blob) { throw new AxiosError('Blob is not supported', AxiosError.ERR_NOT_SUPPORT); @@ -24870,10 +25582,10 @@ const formDataToStream = (form, headersHandler, options) => { boundary = tag + '-' + platform.generateString(size, BOUNDARY_ALPHABET) } = options || {}; if (!utils$1.isFormData(form)) { - throw TypeError('FormData instance required'); + throw new TypeError('FormData instance required'); } if (boundary.length < 1 || boundary.length > 70) { - throw Error('boundary must be 1-70 characters long'); + throw new Error('boundary must be 1-70 characters long'); } const boundaryBytes = textEncoder.encode('--' + boundary + CRLF); const footerBytes = textEncoder.encode('--' + boundary + '--' + CRLF); @@ -24923,26 +25635,125 @@ class ZlibHeaderTransformStream extends stream.Transform { } } -const callbackify = (fn, reducer) => { - return utils$1.isAsyncFn(fn) ? function (...args) { - const cb = args.pop(); - fn.apply(this, args).then(value => { - try { - reducer ? cb(null, ...reducer(value)) : cb(null, value); - } catch (err) { - cb(err); - } - }, cb); - } : fn; -}; +class Http2Sessions { + constructor() { + this.sessions = Object.create(null); + } + getSession(authority, options) { + options = Object.assign({ + sessionTimeout: 1000 + }, options); + let authoritySessions = this.sessions[authority]; + if (authoritySessions) { + let len = authoritySessions.length; + for (let i = 0; i < len; i++) { + const [sessionHandle, sessionOptions] = authoritySessions[i]; + if (!sessionHandle.destroyed && !sessionHandle.closed && util.isDeepStrictEqual(sessionOptions, options)) { + return sessionHandle; + } + } + } + const session = http2.connect(authority, options); + let removed; + let timer; + const removeSession = () => { + if (removed) { + return; + } + removed = true; + if (timer) { + clearTimeout(timer); + timer = null; + } + let entries = authoritySessions, + len = entries.length, + i = len; + while (i--) { + if (entries[i][0] === session) { + if (len === 1) { + delete this.sessions[authority]; + } else { + entries.splice(i, 1); + } + if (!session.closed) { + session.close(); + } + return; + } + } + }; + const originalRequestFn = session.request; + const { + sessionTimeout + } = options; + if (sessionTimeout != null) { + let streamsCount = 0; + session.request = function () { + const stream = originalRequestFn.apply(this, arguments); + streamsCount++; + if (timer) { + clearTimeout(timer); + timer = null; + } + stream.once('close', () => { + if (! --streamsCount) { + timer = setTimeout(() => { + timer = null; + removeSession(); + }, sessionTimeout); + } + }); + return stream; + }; + } + session.once('close', removeSession); + let entry = [session, options]; + authoritySessions ? authoritySessions.push(entry) : authoritySessions = this.sessions[authority] = [entry]; + return session; + } +} + +const callbackify = (fn, reducer) => { + return utils$1.isAsyncFn(fn) ? function (...args) { + const cb = args.pop(); + fn.apply(this, args).then(value => { + try { + reducer ? cb(null, ...reducer(value)) : cb(null, value); + } catch (err) { + cb(err); + } + }, cb); + } : fn; +}; -const LOOPBACK_HOSTNAMES = new Set(['localhost']); +const LOOPBACK_HOSTNAMES = new Set(['localhost', '0.0.0.0']); const isIPv4Loopback = host => { const parts = host.split('.'); if (parts.length !== 4) return false; if (parts[0] !== '127') return false; return parts.every(p => /^\d+$/.test(p) && Number(p) >= 0 && Number(p) <= 255); }; +const isIPv6ZeroGroup = group => /^0{1,4}$/.test(group); + +// The unspecified address (IPv4 0.0.0.0 / IPv6 ::) resolves to the local host +// for outbound connections, so treat it as loopback-equivalent for NO_PROXY +// matching. 0.0.0.0 is covered by LOOPBACK_HOSTNAMES; this handles compressed +// and full IPv6 all-zero forms so both families bypass symmetrically. +const isIPv6Unspecified = host => { + if (host === '::') return true; + const compressionIndex = host.indexOf('::'); + if (compressionIndex !== -1) { + if (compressionIndex !== host.lastIndexOf('::')) return false; + const left = host.slice(0, compressionIndex); + const right = host.slice(compressionIndex + 2); + const leftGroups = left ? left.split(':') : []; + const rightGroups = right ? right.split(':') : []; + const explicitGroups = leftGroups.length + rightGroups.length; + return explicitGroups < 8 && leftGroups.every(isIPv6ZeroGroup) && rightGroups.every(isIPv6ZeroGroup); + } + const groups = host.split(':'); + return groups.length === 8 && groups.every(isIPv6ZeroGroup); +}; const isIPv6Loopback = host => { // Collapse all-zero groups: any form of ::1 / 0:0:...:0:1 // First, strip any leading "::" by normalising with Set lookup of common forms, @@ -24975,6 +25786,7 @@ const isLoopback = host => { if (!host) return false; if (LOOPBACK_HOSTNAMES.has(host)) return true; if (isIPv4Loopback(host)) return true; + if (isIPv6Unspecified(host)) return true; return isIPv6Loopback(host); }; const DEFAULT_PORTS = { @@ -25157,6 +25969,9 @@ const progressEventReducer = (listener, isDownloadStream, freq = 3) => { let bytesNotified = 0; const _speedometer = speedometer(50, 250); return throttle(e => { + if (!e || typeof e.loaded !== 'number') { + return; + } const rawLoaded = e.loaded; const total = e.lengthComputable ? e.total : undefined; const loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded; @@ -25191,11 +26006,13 @@ const asyncDecorator = fn => (...args) => utils$1.asap(() => fn(...args)); * Estimate decoded byte length of a data:// URL *without* allocating large buffers. * - For base64: compute exact decoded size using length and padding; * handle %XX at the character-count level (no string allocation). - * - For non-base64: use UTF-8 byteLength of the encoded body as a safe upper bound. + * - For non-base64: compute the exact percent-decoded UTF-8 byte length. * * @param {string} url * @returns {number} */ +const isHexDigit = charCode => charCode >= 48 && charCode <= 57 || charCode >= 65 && charCode <= 70 || charCode >= 97 && charCode <= 102; +const isPercentEncodedByte = (str, i, len) => i + 2 < len && isHexDigit(str.charCodeAt(i + 1)) && isHexDigit(str.charCodeAt(i + 2)); function estimateDataURLDecodedBytes(url) { if (!url || typeof url !== 'string') return 0; if (!url.startsWith('data:')) return 0; @@ -25212,7 +26029,7 @@ function estimateDataURLDecodedBytes(url) { if (body.charCodeAt(i) === 37 /* '%' */ && i + 2 < len) { const a = body.charCodeAt(i + 1); const b = body.charCodeAt(i + 2); - const isHex = (a >= 48 && a <= 57 || a >= 65 && a <= 70 || a >= 97 && a <= 102) && (b >= 48 && b <= 57 || b >= 65 && b <= 70 || b >= 97 && b <= 102); + const isHex = isHexDigit(a) && isHexDigit(b); if (isHex) { effectiveLen -= 2; i += 2; @@ -25247,18 +26064,18 @@ function estimateDataURLDecodedBytes(url) { const bytes = groups * 3 - (pad || 0); return bytes > 0 ? bytes : 0; } - if (typeof Buffer !== 'undefined' && typeof Buffer.byteLength === 'function') { - return Buffer.byteLength(body, 'utf8'); - } // Compute UTF-8 byte length directly from UTF-16 code units without allocating // a byte buffer (TextEncoder.encode would defeat the DoS guard on large bodies). - // Using body.length here would undercount non-ASCII (e.g. '€' is 1 code unit - // but 3 UTF-8 bytes). + // Valid %XX triplets count as one decoded byte; this matches the bytes that + // decodeURIComponent(body) would produce before Buffer re-encodes the string. let bytes = 0; for (let i = 0, len = body.length; i < len; i++) { const c = body.charCodeAt(i); - if (c < 0x80) { + if (c === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) { + bytes += 1; + i += 2; + } else if (c < 0x80) { bytes += 1; } else if (c < 0x800) { bytes += 2; @@ -25285,7 +26102,14 @@ const brotliOptions = { flush: zlib.constants.BROTLI_OPERATION_FLUSH, finishFlush: zlib.constants.BROTLI_OPERATION_FLUSH }; +const zstdOptions = { + flush: zlib.constants.ZSTD_e_flush, + finishFlush: zlib.constants.ZSTD_e_flush +}; const isBrotliSupported = utils$1.isFunction(zlib.createBrotliDecompress); +const isZstdSupported = utils$1.isFunction(zlib.createZstdDecompress); +const ACCEPT_ENCODING = 'gzip, compress, deflate' + (isBrotliSupported ? ', br' : ''); +const ACCEPT_ENCODING_WITH_ZSTD = ACCEPT_ENCODING + (isZstdSupported ? ', zstd' : ''); const { http: httpFollow, https: httpsFollow @@ -25308,6 +26132,78 @@ function setFormDataHeaders$1(headers, formHeaders, policy) { // the request currently owning that socket across keep-alive reuse (issue #10780). const kAxiosSocketListener = Symbol('axios.http.socketListener'); const kAxiosCurrentReq = Symbol('axios.http.currentReq'); + +// Tags HttpsProxyAgent instances installed by setProxy() so the redirect path +// can strip them without clobbering a user-supplied agent that happens to be +// an HttpsProxyAgent. +const kAxiosInstalledTunnel = Symbol('axios.http.installedTunnel'); + +// Cache of CONNECT-tunneling agents keyed by proxy config so repeat requests +// through the same proxy reuse a single agent (and its socket pool). The +// keyspace is bounded by the set of distinct proxy configs the process uses, +// so unbounded growth is not a concern in practice. +const tunnelingAgentCache = new Map(); +const tunnelingAgentCacheUser = new WeakMap(); +// Minimum minor versions where Node's HTTP Agent supports native proxyEnv +// handling. Checking the selected agent below also covers startup modes such +// as NODE_OPTIONS=--use-env-proxy and --no-use-env-proxy precedence. +const NODE_NATIVE_ENV_PROXY_SUPPORT = { + 22: 21, + 24: 5 +}; +function isNodeNativeEnvProxySupported(nodeVersion = process.versions && process.versions.node) { + if (!nodeVersion) { + return false; + } + const [major, minor] = nodeVersion.split('.').map(part => Number(part)); + if (!Number.isInteger(major) || !Number.isInteger(minor)) { + return false; + } + if (major > 24) { + return true; + } + return NODE_NATIVE_ENV_PROXY_SUPPORT[major] != null && minor >= NODE_NATIVE_ENV_PROXY_SUPPORT[major]; +} +function isNodeEnvProxyEnabled(agent, nodeVersion = process.versions && process.versions.node) { + if (!isNodeNativeEnvProxySupported(nodeVersion)) { + return false; + } + const agentOptions = agent && agent.options; + return Boolean(agentOptions && utils$1.hasOwnProp(agentOptions, 'proxyEnv') && agentOptions.proxyEnv != null); +} +function getProxyEnvAgent(options, configHttpAgent, configHttpsAgent) { + return isHttps.test(options.protocol) ? configHttpsAgent || https.globalAgent : configHttpAgent || http.globalAgent; +} +function getTunnelingAgent(agentOptions, userHttpsAgent) { + const key = agentOptions.protocol + '//' + agentOptions.hostname + ':' + (agentOptions.port || '') + '#' + (agentOptions.auth || ''); + const cache = userHttpsAgent ? tunnelingAgentCacheUser.get(userHttpsAgent) || tunnelingAgentCacheUser.set(userHttpsAgent, new Map()).get(userHttpsAgent) : tunnelingAgentCache; + let agent = cache.get(key); + if (agent) return agent; + // Forward the user's TLS options (custom CA, rejectUnauthorized, client cert, + // etc.) into the tunneling agent so they apply to the origin TLS upgrade + // performed after CONNECT. Our proxy fields take precedence on conflict. + const merged = userHttpsAgent && userHttpsAgent.options ? { + ...userHttpsAgent.options, + ...agentOptions + } : agentOptions; + agent = new HttpsProxyAgent(merged); + if (userHttpsAgent && userHttpsAgent.options) { + const originTLSOptions = { + ...userHttpsAgent.options + }; + const callback = agent.callback; + agent.callback = function axiosTunnelingAgentCallback(req, opts) { + // HttpsProxyAgent v5 reads callback opts for the post-CONNECT origin TLS upgrade. + return callback.call(this, req, { + ...originTLSOptions, + ...opts + }); + }; + } + agent[kAxiosInstalledTunnel] = true; + cache.set(key, agent); + return agent; +} const supportedProtocols = platform.protocols.map(protocol => { return protocol + ':'; }); @@ -25316,7 +26212,7 @@ const supportedProtocols = platform.protocols.map(protocol => { // Decode before composing the `auth` option so credentials such as // `my%40email.com:pass` are sent as `my@email.com:pass`. Falls back to the // original value for malformed input so a bad encoding never throws. -const decodeURIComponentSafe = value => { +const decodeURIComponentSafe$1 = value => { if (!utils$1.isString(value)) { return value; } @@ -25330,84 +26226,11 @@ const flushOnFinish = (stream, [throttled, flush]) => { stream.on('end', flush).on('error', flush); return throttled; }; -class Http2Sessions { - constructor() { - this.sessions = Object.create(null); - } - getSession(authority, options) { - options = Object.assign({ - sessionTimeout: 1000 - }, options); - let authoritySessions = this.sessions[authority]; - if (authoritySessions) { - let len = authoritySessions.length; - for (let i = 0; i < len; i++) { - const [sessionHandle, sessionOptions] = authoritySessions[i]; - if (!sessionHandle.destroyed && !sessionHandle.closed && util.isDeepStrictEqual(sessionOptions, options)) { - return sessionHandle; - } - } - } - const session = http2.connect(authority, options); - let removed; - const removeSession = () => { - if (removed) { - return; - } - removed = true; - let entries = authoritySessions, - len = entries.length, - i = len; - while (i--) { - if (entries[i][0] === session) { - if (len === 1) { - delete this.sessions[authority]; - } else { - entries.splice(i, 1); - } - if (!session.closed) { - session.close(); - } - return; - } - } - }; - const originalRequestFn = session.request; - const { - sessionTimeout - } = options; - if (sessionTimeout != null) { - let timer; - let streamsCount = 0; - session.request = function () { - const stream = originalRequestFn.apply(this, arguments); - streamsCount++; - if (timer) { - clearTimeout(timer); - timer = null; - } - stream.once('close', () => { - if (! --streamsCount) { - timer = setTimeout(() => { - timer = null; - removeSession(); - }, sessionTimeout); - } - }); - return stream; - }; - } - session.once('close', removeSession); - let entry = [session, options]; - authoritySessions ? authoritySessions.push(entry) : authoritySessions = this.sessions[authority] = [entry]; - return session; - } -} const http2Sessions = new Http2Sessions(); /** - * If the proxy or config beforeRedirects functions are defined, call them with the options - * object. + * If the proxy, auth, sensitive header, or config beforeRedirects functions are defined, + * call them with the options object. * * @param {Object} options - The options object that was passed to the request. * @@ -25417,10 +26240,37 @@ function dispatchBeforeRedirect(options, responseDetails, requestDetails) { if (options.beforeRedirects.proxy) { options.beforeRedirects.proxy(options); } + if (options.beforeRedirects.auth) { + options.beforeRedirects.auth(options); + } + if (options.beforeRedirects.sensitiveHeaders) { + options.beforeRedirects.sensitiveHeaders(options, requestDetails); + } if (options.beforeRedirects.config) { options.beforeRedirects.config(options, responseDetails, requestDetails); } } +function stripMatchingHeaders(headers, sensitiveSet) { + if (!headers) { + return; + } + Object.keys(headers).forEach(header => { + if (sensitiveSet.has(header.toLowerCase())) { + delete headers[header]; + } + }); +} +function isSameOriginRedirect(redirectOptions, requestDetails) { + if (!requestDetails) { + return false; + } + try { + return new URL(requestDetails.url).origin === new URL(redirectOptions.href).origin; + } catch (e) { + // If origin comparison fails, treat the redirect as unsafe. + return false; + } +} /** * If the proxy or config afterRedirects functions are defined, call them with the options @@ -25431,9 +26281,10 @@ function dispatchBeforeRedirect(options, responseDetails, requestDetails) { * * @returns {http.ClientRequestArgs} */ -function setProxy(options, configProxy, location, isRedirect) { +function setProxy(options, configProxy, location, isRedirect, configHttpsAgent, configHttpAgent) { let proxy = configProxy; - if (!proxy && proxy !== false) { + const proxyEnvAgent = getProxyEnvAgent(options, configHttpAgent, configHttpsAgent); + if (!proxy && proxy !== false && !isNodeEnvProxyEnabled(proxyEnvAgent)) { const proxyUrl = getProxyForUrl(location); if (proxyUrl) { if (!shouldBypassProxy(location)) { @@ -25452,6 +26303,13 @@ function setProxy(options, configProxy, location, isRedirect) { } } } + // Strip any tunneling agent we installed for the previous hop so a redirect + // that drops the proxy or crosses an HTTPS↔HTTP boundary doesn't reuse a + // stale one. Match on our Symbol marker so a user-supplied HttpsProxyAgent + // (which won't carry the marker) is left alone. + if (isRedirect && options.agent && options.agent[kAxiosInstalledTunnel]) { + options.agent = undefined; + } if (proxy) { // Read proxy fields without traversing the prototype chain. URL instances expose // username/password/hostname/host/port/protocol via getters on URL.prototype (so @@ -25484,37 +26342,84 @@ function setProxy(options, configProxy, location, isRedirect) { proxy }); } - const base64 = Buffer.from(proxyAuth, 'utf8').toString('base64'); - options.headers['Proxy-Authorization'] = 'Basic ' + base64; } - - // Preserve a user-supplied Host header (case-insensitive) so callers can override - // the value forwarded to the proxy; otherwise default to the request URL's host. - let hasUserHostHeader = false; - for (const name of Object.keys(options.headers)) { - if (name.toLowerCase() === 'host') { - hasUserHostHeader = true; - break; + const targetIsHttps = isHttps.test(options.protocol); + if (targetIsHttps) { + // CONNECT-tunneling path for HTTPS targets. Preserves end-to-end TLS to + // the origin so the proxy cannot inspect the URL, headers, or body — the + // behavior already promised by THREATMODEL.md (T-R9). HttpsProxyAgent + // sends Proxy-Authorization on the CONNECT request only, never on the + // wrapped TLS request, which is why we don't stamp it onto + // options.headers here. If the user already supplied an HttpsProxyAgent, + // they own tunneling end-to-end and we leave them alone; otherwise we + // install our own tunneling agent and forward their TLS options (if any) + // so a custom httpsAgent for cert pinning / rejectUnauthorized still + // applies to the origin TLS upgrade. + if (!(configHttpsAgent instanceof HttpsProxyAgent)) { + const proxyHost = readProxyField('hostname') || readProxyField('host'); + const proxyPort = readProxyField('port'); + const rawProxyProtocol = readProxyField('protocol'); + const normalizedProtocol = rawProxyProtocol ? rawProxyProtocol.includes(':') ? rawProxyProtocol : `${rawProxyProtocol}:` : 'http:'; + // Bracket IPv6 literals for URL parsing; URL.hostname strips the + // brackets again on read so the agent receives the raw form. + const proxyHostForURL = proxyHost && proxyHost.includes(':') && !proxyHost.startsWith('[') ? `[${proxyHost}]` : proxyHost; + const proxyURL = new URL(`${normalizedProtocol}//${proxyHostForURL}${proxyPort ? ':' + proxyPort : ''}`); + const agentOptions = { + protocol: proxyURL.protocol, + hostname: proxyURL.hostname.replace(/^\[|\]$/g, ''), + port: proxyURL.port, + auth: proxyAuth && typeof proxyAuth === 'string' ? proxyAuth : undefined + }; + if (proxyURL.protocol === 'https:') { + agentOptions.ALPNProtocols = ['http/1.1']; + } + const tunnelingAgent = getTunnelingAgent(agentOptions, configHttpsAgent); + // Set both: `options.agent` is consumed by the native https.request path + // (maxRedirects === 0); `options.agents.https` is consumed by + // follow-redirects, which ignores `options.agent` when `options.agents` + // is present. + options.agent = tunnelingAgent; + if (options.agents) { + options.agents.https = tunnelingAgent; + } + } + } else { + // Forward-proxy mode for plaintext HTTP targets. The request line carries + // the absolute URL and the proxy sees everything — acceptable for plain + // HTTP since the wire was already plaintext. + if (proxyAuth) { + const base64 = Buffer.from(proxyAuth, 'utf8').toString('base64'); + options.headers['Proxy-Authorization'] = 'Basic ' + base64; + } + + // Preserve a user-supplied Host header (case-insensitive) so callers can override + // the value forwarded to the proxy; otherwise default to the request URL's host. + let hasUserHostHeader = false; + for (const name of Object.keys(options.headers)) { + if (name.toLowerCase() === 'host') { + hasUserHostHeader = true; + break; + } + } + if (!hasUserHostHeader) { + options.headers.host = options.hostname + (options.port ? ':' + options.port : ''); + } + const proxyHost = readProxyField('hostname') || readProxyField('host'); + options.hostname = proxyHost; + // Replace 'host' since options is not a URL object + options.host = proxyHost; + options.port = readProxyField('port'); + options.path = location; + const proxyProtocol = readProxyField('protocol'); + if (proxyProtocol) { + options.protocol = proxyProtocol.includes(':') ? proxyProtocol : `${proxyProtocol}:`; } - } - if (!hasUserHostHeader) { - options.headers.host = options.hostname + (options.port ? ':' + options.port : ''); - } - const proxyHost = readProxyField('hostname') || readProxyField('host'); - options.hostname = proxyHost; - // Replace 'host' since options is not a URL object - options.host = proxyHost; - options.port = readProxyField('port'); - options.path = location; - const proxyProtocol = readProxyField('protocol'); - if (proxyProtocol) { - options.protocol = proxyProtocol.includes(':') ? proxyProtocol : `${proxyProtocol}:`; } } options.beforeRedirects.proxy = function beforeRedirect(redirectOptions) { // Configure proxy for redirected request, passing the original config proxy to apply // the exact same logic as if the redirected request was performed by axios directly. - setProxy(redirectOptions, configProxy, redirectOptions.href, true); + setProxy(redirectOptions, configProxy, redirectOptions.href, true, configHttpsAgent, configHttpAgent); }; } const isHttpAdapterSupported = typeof process !== 'undefined' && utils$1.kindOf(process) === 'process'; @@ -25597,16 +26502,30 @@ const http2Transport = { /*eslint consistent-return:0*/ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { return wrapAsync(async function dispatchHttpRequest(resolve, reject, onDone) { - const own = key => utils$1.hasOwnProp(config, key) ? config[key] : undefined; + // Read config pollution-safely: own properties and members inherited from + // a non-Object.prototype source (e.g. an Object.create(defaults) template) + // are honored, but values injected onto a polluted Object.prototype are + // ignored. All behavior-affecting reads in this adapter go through own() + // so the protection boundary stays consistent. + const own = key => utils$1.getSafeProp(config, key); + const transitional = own('transitional') || transitionalDefaults; let data = own('data'); let lookup = own('lookup'); let family = own('family'); let httpVersion = own('httpVersion'); if (httpVersion === undefined) httpVersion = 1; let http2Options = own('http2Options'); + const httpAgent = own('httpAgent'); + const httpsAgent = own('httpsAgent'); + const configProxy = own('proxy'); const responseType = own('responseType'); const responseEncoding = own('responseEncoding'); - const method = config.method.toUpperCase(); + const socketPath = own('socketPath'); + const method = own('method').toUpperCase(); + const maxRedirects = own('maxRedirects'); + const maxBodyLength = own('maxBodyLength'); + const maxContentLength = own('maxContentLength'); + const decompress = own('decompress'); let isDone; let rejected = false; let req; @@ -25637,7 +26556,7 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { try { abortEmitter.emit('abort', !reason || reason.type ? new CanceledError(null, config, req) : reason); } catch (err) { - console.warn('emit error', err); + // ignore emit errors } } function clearConnectPhaseTimer() { @@ -25647,10 +26566,11 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { } } function createTimeoutError() { - let timeoutErrorMessage = config.timeout ? 'timeout of ' + config.timeout + 'ms exceeded' : 'timeout exceeded'; - const transitional = config.transitional || transitionalDefaults; - if (config.timeoutErrorMessage) { - timeoutErrorMessage = config.timeoutErrorMessage; + const configTimeout = own('timeout'); + let timeoutErrorMessage = configTimeout ? 'timeout of ' + configTimeout + 'ms exceeded' : 'timeout exceeded'; + const configTimeoutErrorMessage = own('timeoutErrorMessage'); + if (configTimeoutErrorMessage) { + timeoutErrorMessage = configTimeoutErrorMessage; } return new AxiosError(timeoutErrorMessage, transitional.clarifyTimeoutError ? AxiosError.ETIMEDOUT : AxiosError.ECONNABORTED, config, req); } @@ -25693,17 +26613,22 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { }); // Parse url - const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls); - const parsed = new URL(fullPath, platform.hasBrowserEnv ? platform.origin : undefined); + const fullPath = buildFullPath(own('baseURL'), own('url'), own('allowAbsoluteUrls'), config); + // Unix-socket requests (own socketPath) commonly pass a path-only url + // like '/foo'; supply a synthetic base so new URL() can still parse it. + // Use the own-property value (not config.socketPath) so a polluted + // prototype cannot influence URL base selection. + const urlBase = socketPath ? 'http://localhost' : platform.hasBrowserEnv ? platform.origin : undefined; + const parsed = new URL(fullPath, urlBase); const protocol = parsed.protocol || supportedProtocols[0]; if (protocol === 'data:') { // Apply the same semantics as HTTP: only enforce if a finite, non-negative cap is set. - if (config.maxContentLength > -1) { - // Use the exact string passed to fromDataURI (config.url); fall back to fullPath if needed. - const dataUrl = String(config.url || fullPath || ''); + if (maxContentLength > -1) { + // Use the exact string passed to fromDataURI (the configured url); fall back to fullPath if needed. + const dataUrl = String(own('url') || fullPath || ''); const estimated = estimateDataURLDecodedBytes(dataUrl); - if (estimated > config.maxContentLength) { - return reject(new AxiosError('maxContentLength size of ' + config.maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config)); + if (estimated > maxContentLength) { + return reject(new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config)); } } let convertedData; @@ -25716,7 +26641,7 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { }); } try { - convertedData = fromDataURI(config.url, responseType === 'blob', { + convertedData = fromDataURI(own('url'), responseType === 'blob', { Blob: config.env && config.env.Blob }); } catch (err) { @@ -25790,7 +26715,7 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { // Add Content-Length header if data exists headers.setContentLength(data.length, false); - if (config.maxBodyLength > -1 && data.length > config.maxBodyLength) { + if (maxBodyLength > -1 && data.length > maxBodyLength) { return reject(new AxiosError('Request body larger than maxBodyLength limit', AxiosError.ERR_BAD_REQUEST, config)); } } @@ -25817,37 +26742,36 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { let auth = undefined; const configAuth = own('auth'); if (configAuth) { - const username = configAuth.username || ''; - const password = configAuth.password || ''; + const username = utils$1.getSafeProp(configAuth, 'username') || ''; + const password = utils$1.getSafeProp(configAuth, 'password') || ''; auth = username + ':' + password; } - if (!auth && parsed.username) { - const urlUsername = decodeURIComponentSafe(parsed.username); - const urlPassword = decodeURIComponentSafe(parsed.password); + if (!auth && (parsed.username || parsed.password)) { + const urlUsername = decodeURIComponentSafe$1(parsed.username); + const urlPassword = decodeURIComponentSafe$1(parsed.password); auth = urlUsername + ':' + urlPassword; } auth && headers.delete('authorization'); let path$1; try { - path$1 = buildURL(parsed.pathname + parsed.search, config.params, config.paramsSerializer).replace(/^\?/, ''); + path$1 = buildURL(parsed.pathname + parsed.search, own('params'), own('paramsSerializer')).replace(/^\?/, ''); } catch (err) { - const customErr = new Error(err.message); - customErr.config = config; - customErr.url = config.url; - customErr.exists = true; - return reject(customErr); + return reject(AxiosError.from(err, AxiosError.ERR_BAD_REQUEST, config, null, null, { + url: own('url'), + exists: true + })); } - headers.set('Accept-Encoding', 'gzip, compress, deflate' + (isBrotliSupported ? ', br' : ''), false); + headers.set('Accept-Encoding', utils$1.hasOwnProp(transitional, 'advertiseZstdAcceptEncoding') && transitional.advertiseZstdAcceptEncoding === true ? ACCEPT_ENCODING_WITH_ZSTD : ACCEPT_ENCODING, false); // Null-prototype to block prototype pollution gadgets on properties read // directly by Node's http.request (e.g. insecureHTTPParser, lookup). const options = Object.assign(Object.create(null), { path: path$1, method: method, - headers: headers.toJSON(), + headers: toByteStringHeaderObject(headers), agents: { - http: config.httpAgent, - https: config.httpsAgent + http: httpAgent, + https: httpsAgent }, auth, protocol, @@ -25859,52 +26783,105 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { // cacheable-lookup integration hotfix !utils$1.isUndefined(lookup) && (options.lookup = lookup); - if (config.socketPath) { - if (typeof config.socketPath !== 'string') { + if (socketPath) { + if (typeof socketPath !== 'string') { return reject(new AxiosError('socketPath must be a string', AxiosError.ERR_BAD_OPTION_VALUE, config)); } - if (config.allowedSocketPaths != null) { - const allowed = Array.isArray(config.allowedSocketPaths) ? config.allowedSocketPaths : [config.allowedSocketPaths]; - const resolvedSocket = path.resolve(config.socketPath); + const allowedSocketPaths = own('allowedSocketPaths'); + if (allowedSocketPaths != null) { + const allowed = Array.isArray(allowedSocketPaths) ? allowedSocketPaths : [allowedSocketPaths]; + const resolvedSocket = path.resolve(socketPath); const isAllowed = allowed.some(entry => typeof entry === 'string' && path.resolve(entry) === resolvedSocket); if (!isAllowed) { - return reject(new AxiosError(`socketPath "${config.socketPath}" is not permitted by allowedSocketPaths`, AxiosError.ERR_BAD_OPTION_VALUE, config)); + return reject(new AxiosError(`socketPath "${socketPath}" is not permitted by allowedSocketPaths`, AxiosError.ERR_BAD_OPTION_VALUE, config)); } } - options.socketPath = config.socketPath; + options.socketPath = socketPath; } else { options.hostname = parsed.hostname.startsWith('[') ? parsed.hostname.slice(1, -1) : parsed.hostname; options.port = parsed.port; - setProxy(options, config.proxy, protocol + '//' + parsed.hostname + (parsed.port ? ':' + parsed.port : '') + options.path); + setProxy(options, configProxy, protocol + '//' + parsed.hostname + (parsed.port ? ':' + parsed.port : '') + options.path, false, httpsAgent, httpAgent); } let transport; let isNativeTransport = false; + // True only for the follow-redirects transport, which applies + // options.maxBodyLength itself. Every other transport (http2, native + // http/https, a user-supplied custom transport) needs the explicit + // byte-counting pipeline below to enforce maxBodyLength on streamed uploads. + let transportEnforcesMaxBodyLength = false; const isHttpsRequest = isHttps.test(options.protocol); - options.agent = isHttpsRequest ? config.httpsAgent : config.httpAgent; + // Don't clobber a CONNECT-tunneling agent installed by setProxy() for an + // HTTPS target. + if (options.agent == null) { + options.agent = isHttpsRequest ? httpsAgent : httpAgent; + } if (isHttp2) { transport = http2Transport; } else { const configTransport = own('transport'); if (configTransport) { transport = configTransport; - } else if (config.maxRedirects === 0) { + } else if (maxRedirects === 0) { transport = isHttpsRequest ? https : http; isNativeTransport = true; } else { - if (config.maxRedirects) { - options.maxRedirects = config.maxRedirects; + transportEnforcesMaxBodyLength = true; + options.sensitiveHeaders = []; + if (maxRedirects) { + options.maxRedirects = maxRedirects; } const configBeforeRedirect = own('beforeRedirect'); if (configBeforeRedirect) { options.beforeRedirects.config = configBeforeRedirect; } + if (auth) { + // Restore HTTP Basic credentials on same-origin redirects only. + // follow-redirects >= 1.15.8 strips Authorization on every redirect (see #6929); + // cross-origin stripping is the documented mitigation for T-R2 in THREATMODEL.md + // and is preserved by deliberately not restoring on origin change. + const requestOrigin = parsed.origin; + const authToRestore = auth; + options.beforeRedirects.auth = function beforeRedirectAuth(redirectOptions) { + try { + if (new URL(redirectOptions.href).origin === requestOrigin) { + redirectOptions.auth = authToRestore; + } + } catch (e) { + // ignore malformed URL: leaving auth stripped is fail-safe + } + }; + } + const sensitiveHeaders = own('sensitiveHeaders'); + if (sensitiveHeaders != null) { + if (!utils$1.isArray(sensitiveHeaders)) { + return reject(new AxiosError('sensitiveHeaders must be an array of strings', AxiosError.ERR_BAD_OPTION_VALUE, config)); + } + const sensitiveSet = new Set(); + for (const header of sensitiveHeaders) { + if (!utils$1.isString(header)) { + return reject(new AxiosError('sensitiveHeaders must be an array of strings', AxiosError.ERR_BAD_OPTION_VALUE, config)); + } + sensitiveSet.add(header.toLowerCase()); + } + if (sensitiveSet.size) { + options.sensitiveHeaders = Array.from(sensitiveSet); + options.beforeRedirects.sensitiveHeaders = function beforeRedirectSensitiveHeaders(redirectOptions, requestDetails) { + if (!isSameOriginRedirect(redirectOptions, requestDetails)) { + stripMatchingHeaders(redirectOptions.headers, sensitiveSet); + } + }; + } + } transport = isHttpsRequest ? httpsFollow : httpFollow; } } - if (config.maxBodyLength > -1) { - options.maxBodyLength = config.maxBodyLength; + + // Set an explicit maxBodyLength option for transports that inspect it. + // When maxBodyLength is -1 (default/unlimited), use Infinity so + // follow-redirects does not fall back to its own 10MB default. + if (maxBodyLength > -1) { + options.maxBodyLength = maxBodyLength; } else { - // follow-redirects does not skip comparison, so it should always succeed for axios -1 unlimited options.maxBodyLength = Infinity; } @@ -25934,7 +26911,7 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { const lastRequest = res.req || req; // if decompress disabled we should not decompress - if (config.decompress !== false && res.headers['content-encoding']) { + if (decompress !== false && res.headers['content-encoding']) { // if no content, but headers still say that it is encoded, // remove the header not confuse downstream operations if (method === 'HEAD' || res.statusCode === 204) { @@ -25966,6 +26943,13 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { streams.push(zlib.createBrotliDecompress(brotliOptions)); delete res.headers['content-encoding']; } + break; + case 'zstd': + if (isZstdSupported) { + streams.push(zlib.createZstdDecompress(zstdOptions)); + delete res.headers['content-encoding']; + } + break; } } responseStream = streams.length > 1 ? stream.pipeline(streams, utils$1.noop) : streams[0]; @@ -25979,8 +26963,8 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { if (responseType === 'stream') { // Enforce maxContentLength on streamed responses; previously this // was applied only to buffered responses. - if (config.maxContentLength > -1) { - const limit = config.maxContentLength; + if (maxContentLength > -1) { + const limit = maxContentLength; const source = responseStream; async function* enforceMaxContentLength() { let totalResponseBytes = 0; @@ -26006,11 +26990,11 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { totalResponseBytes += chunk.length; // make sure the content length is not over the maxContentLength if specified - if (config.maxContentLength > -1 && totalResponseBytes > config.maxContentLength) { + if (maxContentLength > -1 && totalResponseBytes > maxContentLength) { // stream.destroy() emit aborted event before calling reject() on Node.js v16 rejected = true; responseStream.destroy(); - abort(new AxiosError('maxContentLength size of ' + config.maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config, lastRequest)); + abort(new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config, lastRequest)); } }); responseStream.on('aborted', function handlerStreamAborted() { @@ -26073,7 +27057,11 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { const boundSockets = new Set(); req.on('socket', function handleRequestSocket(socket) { // default interval of sending ack packet is 1 minute - socket.setKeepAlive(true, 1000 * 60); + // proxy agents (e.g. agent-base) may return a generic Duplex stream + // that doesn't have setKeepAlive, so guard before calling + if (typeof socket.setKeepAlive === 'function') { + socket.setKeepAlive(true, 1000 * 60); + } // Install a single 'error' listener per socket (not per request) to avoid // accumulating listeners on pooled keep-alive sockets that get reassigned @@ -26103,9 +27091,9 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { }); // Handle request timeout - if (config.timeout) { + if (own('timeout')) { // This is forcing a int timeout to avoid problems if the `req` interface doesn't handle other types. - const timeout = parseInt(config.timeout, 10); + const timeout = parseInt(own('timeout'), 10); if (Number.isNaN(timeout)) { abort(new AxiosError('error trying to parse `config.timeout` to int', AxiosError.ERR_BAD_OPTION_VALUE, config, req)); return; @@ -26149,12 +27137,13 @@ var httpAdapter = isHttpAdapterSupported && function httpAdapter(config) { } }); - // Enforce maxBodyLength for streamed uploads on the native http/https - // transport (maxRedirects === 0); follow-redirects enforces it on the - // other path. + // Enforce maxBodyLength for streamed uploads on every transport that + // does not apply options.maxBodyLength itself (native http/https, http2, + // and user-supplied custom transports). The follow-redirects transport + // enforces it on the redirected HTTP/1 path. let uploadStream = data; - if (config.maxBodyLength > -1 && config.maxRedirects === 0) { - const limit = config.maxBodyLength; + if (maxBodyLength > -1 && !transportEnforcesMaxBodyLength) { + const limit = maxBodyLength; let bytesSent = 0; uploadStream = stream.pipeline([data, new stream.Transform({ transform(chunk, _enc, cb) { @@ -26217,7 +27206,11 @@ var cookies = platform.hasStandardBrowserEnv ? const cookie = cookies[i].replace(/^\s+/, ''); const eq = cookie.indexOf('='); if (eq !== -1 && cookie.slice(0, eq) === name) { - return decodeURIComponent(cookie.slice(eq + 1)); + try { + return decodeURIComponent(cookie.slice(eq + 1)); + } catch (e) { + return cookie.slice(eq + 1); + } } } return null; @@ -26250,6 +27243,7 @@ const headersToObject = thing => thing instanceof AxiosHeaders ? { */ function mergeConfig(config1, config2) { // eslint-disable-next-line no-param-reassign + config1 = config1 || {}; config2 = config2 || {}; // Use a null-prototype object so that downstream reads such as `config.auth` @@ -26301,6 +27295,23 @@ function mergeConfig(config1, config2) { return getMergedValue(undefined, a); } } + function getMergedTransitionalOption(prop) { + const transitional2 = utils$1.hasOwnProp(config2, 'transitional') ? config2.transitional : undefined; + if (!utils$1.isUndefined(transitional2)) { + if (utils$1.isPlainObject(transitional2)) { + if (utils$1.hasOwnProp(transitional2, prop)) { + return transitional2[prop]; + } + } else { + return undefined; + } + } + const transitional1 = utils$1.hasOwnProp(config1, 'transitional') ? config1.transitional : undefined; + if (utils$1.isPlainObject(transitional1) && utils$1.hasOwnProp(transitional1, prop)) { + return transitional1[prop]; + } + return undefined; + } // eslint-disable-next-line consistent-return function mergeDirectKeys(a, b, prop) { @@ -26353,6 +27364,13 @@ function mergeConfig(config1, config2) { const configValue = merge(a, b, prop); utils$1.isUndefined(configValue) && merge !== mergeDirectKeys || (config[prop] = configValue); }); + if (utils$1.hasOwnProp(config2, 'validateStatus') && utils$1.isUndefined(config2.validateStatus) && getMergedTransitionalOption('validateStatusUndefinedResolves') === false) { + if (utils$1.hasOwnProp(config1, 'validateStatus')) { + config.validateStatus = getMergedValue(undefined, config1.validateStatus); + } else { + delete config.validateStatus; + } + } return config; } @@ -26362,7 +27380,7 @@ function setFormDataHeaders(headers, formHeaders, policy) { headers.set(formHeaders); return; } - Object.entries(formHeaders).forEach(([key, val]) => { + Object.entries(formHeaders || {}).forEach(([key, val]) => { if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) { headers.set(key, val); } @@ -26377,8 +27395,8 @@ function setFormDataHeaders(headers, formHeaders, policy) { * * @returns {string} UTF-8 bytes as a Latin-1 string */ -const encodeUTF8 = str => encodeURIComponent(str).replace(/%([0-9A-F]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16))); -var resolveConfig = config => { +const encodeUTF8$1 = str => encodeURIComponent(str).replace(/%([0-9A-F]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16))); +function resolveConfig(config) { const newConfig = mergeConfig({}, config); // Read only own properties to prevent prototype pollution gadgets @@ -26394,15 +27412,21 @@ var resolveConfig = config => { const allowAbsoluteUrls = own('allowAbsoluteUrls'); const url = own('url'); newConfig.headers = headers = AxiosHeaders.from(headers); - newConfig.url = buildURL(buildFullPath(baseURL, url, allowAbsoluteUrls), config.params, config.paramsSerializer); + newConfig.url = buildURL(buildFullPath(baseURL, url, allowAbsoluteUrls, newConfig), own('params'), own('paramsSerializer')); // HTTP basic authentication if (auth) { - headers.set('Authorization', 'Basic ' + btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))); + const username = utils$1.getSafeProp(auth, 'username') || ''; + const password = utils$1.getSafeProp(auth, 'password') || ''; + try { + headers.set('Authorization', 'Basic ' + btoa(username + ':' + (password ? encodeUTF8$1(password) : ''))); + } catch (e) { + throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config); + } } if (utils$1.isFormData(data)) { - if (platform.hasStandardBrowserEnv || platform.hasStandardBrowserWebWorkerEnv) { - headers.setContentType(undefined); // browser handles it + if (platform.hasStandardBrowserEnv || platform.hasStandardBrowserWebWorkerEnv || utils$1.isReactNative(data)) { + headers.setContentType(undefined); // browser/web worker/RN handles it } else if (utils$1.isFunction(data.getHeaders)) { // Node.js FormData (like form-data package) setFormDataHeaders(headers, data.getHeaders(), own('formDataHeaderPolicy')); @@ -26430,7 +27454,7 @@ var resolveConfig = config => { } } return newConfig; -}; +} const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined'; var xhrAdapter = isXHRAdapterSupported && function (config) { @@ -26552,7 +27576,7 @@ var xhrAdapter = isXHRAdapterSupported && function (config) { // Add headers to the request if ('setRequestHeader' in request) { - utils$1.forEach(requestHeaders.toJSON(), function setRequestHeader(val, key) { + utils$1.forEach(toByteStringHeaderObject(requestHeaders), function setRequestHeader(val, key) { request.setRequestHeader(key, val); }); } @@ -26599,6 +27623,7 @@ var xhrAdapter = isXHRAdapterSupported && function (config) { const protocol = parseProtocol(_config.url); if (protocol && !platform.protocols.includes(protocol)) { reject(new AxiosError('Unsupported protocol ' + protocol + ':', AxiosError.ERR_BAD_REQUEST, config)); + done(); return; } @@ -26608,41 +27633,43 @@ var xhrAdapter = isXHRAdapterSupported && function (config) { }; const composeSignals = (signals, timeout) => { - const { - length - } = signals = signals ? signals.filter(Boolean) : []; - if (timeout || length) { - let controller = new AbortController(); - let aborted; - const onabort = function (reason) { - if (!aborted) { - aborted = true; - unsubscribe(); - const err = reason instanceof Error ? reason : this.reason; - controller.abort(err instanceof AxiosError ? err : new CanceledError(err instanceof Error ? err.message : err)); - } - }; - let timer = timeout && setTimeout(() => { - timer = null; - onabort(new AxiosError(`timeout of ${timeout}ms exceeded`, AxiosError.ETIMEDOUT)); - }, timeout); - const unsubscribe = () => { - if (signals) { - timer && clearTimeout(timer); - timer = null; - signals.forEach(signal => { - signal.unsubscribe ? signal.unsubscribe(onabort) : signal.removeEventListener('abort', onabort); - }); - signals = null; - } - }; - signals.forEach(signal => signal.addEventListener('abort', onabort)); - const { - signal - } = controller; - signal.unsubscribe = () => utils$1.asap(unsubscribe); - return signal; + signals = signals ? signals.filter(Boolean) : []; + if (!timeout && !signals.length) { + return; } + const controller = new AbortController(); + let aborted = false; + const onabort = function (reason) { + if (!aborted) { + aborted = true; + unsubscribe(); + const err = reason instanceof Error ? reason : this.reason; + controller.abort(err instanceof AxiosError ? err : new CanceledError(err instanceof Error ? err.message : err)); + } + }; + let timer = timeout && setTimeout(() => { + timer = null; + onabort(new AxiosError(`timeout of ${timeout}ms exceeded`, AxiosError.ETIMEDOUT)); + }, timeout); + const unsubscribe = () => { + if (!signals) { + return; + } + timer && clearTimeout(timer); + timer = null; + signals.forEach(signal => { + signal.unsubscribe ? signal.unsubscribe(onabort) : signal.removeEventListener('abort', onabort); + }); + signals = null; + }; + signals.forEach(signal => signal.addEventListener('abort', onabort, { + once: true + })); + const { + signal + } = controller; + signal.unsubscribe = () => utils$1.asap(unsubscribe); + return signal; }; const streamChunk = function* (chunk, chunkSize) { @@ -26731,6 +27758,31 @@ const DEFAULT_CHUNK_SIZE = 64 * 1024; const { isFunction } = utils$1; + +/** + * Encode a UTF-8 string to a Latin-1 byte string for use with btoa(). + * This is a modern replacement for the deprecated unescape(encodeURIComponent(str)) pattern. + * + * @param {string} str The string to encode + * + * @returns {string} UTF-8 bytes as a Latin-1 string + */ +const encodeUTF8 = str => encodeURIComponent(str).replace(/%([0-9A-F]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16))); + +// Node's WHATWG URL parser returns `username` and `password` percent-encoded. +// Decode before composing the `auth` option so credentials such as +// `my%40email.com:pass` are sent as `my@email.com:pass`. Falls back to the +// original value for malformed input so a bad encoding never throws. +const decodeURIComponentSafe = value => { + if (!utils$1.isString(value)) { + return value; + } + try { + return decodeURIComponent(value); + } catch (error) { + return value; + } +}; const test = (fn, ...args) => { try { return !!fn(...args); @@ -26738,9 +27790,16 @@ const test = (fn, ...args) => { return false; } }; +const maybeWithAuthCredentials = url => { + const protocolIndex = url.indexOf('://'); + let urlToCheck = url; + if (protocolIndex !== -1) { + urlToCheck = urlToCheck.slice(protocolIndex + 3); + } + return urlToCheck.includes('@') || urlToCheck.includes(':'); +}; const factory = env => { - var _utils$global; - const globalObject = (_utils$global = utils$1.global) !== null && _utils$global !== void 0 ? _utils$global : globalThis; + const globalObject = utils$1.global !== undefined && utils$1.global !== null ? utils$1.global : globalThis; const { ReadableStream, TextEncoder @@ -26842,6 +27901,7 @@ const factory = env => { } = resolveConfig(config); const hasMaxContentLength = utils$1.isNumber(maxContentLength) && maxContentLength > -1; const hasMaxBodyLength = utils$1.isNumber(maxBodyLength) && maxBodyLength > -1; + const own = key => utils$1.hasOwnProp(config, key) ? config[key] : undefined; let _fetch = envFetch || fetch; responseType = responseType ? (responseType + '').toLowerCase() : 'text'; let composedSignal = composeSignals([signal, cancelToken && cancelToken.toAbortSignal()], timeout); @@ -26850,7 +27910,46 @@ const factory = env => { composedSignal.unsubscribe(); }); let requestContentLength; + + // AxiosError we raise while the request body is being streamed. Captured + // by identity so the catch block can surface it directly, regardless of + // how the runtime wraps the resulting fetch rejection (undici exposes it + // as `err.cause`; some browsers drop the original error entirely). + let pendingBodyError = null; + const maxBodyLengthError = () => new AxiosError('Request body larger than maxBodyLength limit', AxiosError.ERR_BAD_REQUEST, config, request); try { + // HTTP basic authentication + let auth = undefined; + const configAuth = own('auth'); + if (configAuth) { + const username = utils$1.getSafeProp(configAuth, 'username') || ''; + const password = utils$1.getSafeProp(configAuth, 'password') || ''; + auth = { + username, + password + }; + } + if (maybeWithAuthCredentials(url)) { + const parsedURL = new URL(url, platform.origin); + if (!auth && (parsedURL.username || parsedURL.password)) { + const urlUsername = decodeURIComponentSafe(parsedURL.username); + const urlPassword = decodeURIComponentSafe(parsedURL.password); + auth = { + username: urlUsername, + password: urlPassword + }; + } + if (parsedURL.username || parsedURL.password) { + parsedURL.username = ''; + parsedURL.password = ''; + url = parsedURL.href; + } + } + if (auth) { + headers.delete('authorization'); + headers.set('Authorization', 'Basic ' + btoa(encodeUTF8((auth.username || '') + ':' + (auth.password || '')))); + } + // Enforce maxContentLength for data: URLs up-front so we never materialize // an oversized payload. The HTTP adapter applies the same check (see http.js // "if (protocol === 'data:')" branch). @@ -26861,30 +27960,54 @@ const factory = env => { } } - // Enforce maxBodyLength against the outbound request body before dispatch. - // Mirrors http.js behavior (ERR_BAD_REQUEST / 'Request body larger than - // maxBodyLength limit'). Skip when the body length cannot be determined - // (e.g. a live ReadableStream supplied by the caller). + // Enforce maxBodyLength against known-size bodies before dispatch using + // the body's *actual* size — never a caller-declared Content-Length, + // which could under-report to slip an oversized body past the check. + // Unknown-size streams return undefined here and are counted per-chunk + // below as fetch consumes them. if (hasMaxBodyLength && method !== 'get' && method !== 'head') { - const outboundLength = await resolveBodyLength(headers, data); - if (typeof outboundLength === 'number' && isFinite(outboundLength) && outboundLength > maxBodyLength) { - throw new AxiosError('Request body larger than maxBodyLength limit', AxiosError.ERR_BAD_REQUEST, config, request); + const outboundLength = await getBodyLength(data); + if (typeof outboundLength === 'number' && isFinite(outboundLength)) { + requestContentLength = outboundLength; + if (outboundLength > maxBodyLength) { + throw maxBodyLengthError(); + } } } - if (onUploadProgress && supportsRequestStream && method !== 'get' && method !== 'head' && (requestContentLength = await resolveBodyLength(headers, data)) !== 0) { - let _request = new Request(url, { - method: 'POST', - body: data, - duplex: 'half' - }); - let contentTypeHeader; - if (utils$1.isFormData(data) && (contentTypeHeader = _request.headers.get('content-type'))) { - headers.setContentType(contentTypeHeader); + + // A streamed body under maxBodyLength must be counted as fetch consumes + // it; its size is never trusted from a caller-declared Content-Length. + const mustEnforceStreamBody = hasMaxBodyLength && (utils$1.isReadableStream(data) || utils$1.isStream(data)); + const trackRequestStream = (stream, onProgress, flush) => trackStream(stream, DEFAULT_CHUNK_SIZE, loadedBytes => { + if (hasMaxBodyLength && loadedBytes > maxBodyLength) { + throw pendingBodyError = maxBodyLengthError(); } - if (_request.body) { - const [onProgress, flush] = progressEventDecorator(requestContentLength, progressEventReducer(asyncDecorator(onUploadProgress))); - data = trackStream(_request.body, DEFAULT_CHUNK_SIZE, onProgress, flush); + onProgress && onProgress(loadedBytes); + }, flush); + if (supportsRequestStream && method !== 'get' && method !== 'head' && (onUploadProgress || mustEnforceStreamBody)) { + requestContentLength = requestContentLength == null ? await resolveBodyLength(headers, data) : requestContentLength; + + // A declared length of 0 is only trusted to skip the wrap when we are + // not enforcing a stream limit (which must not rely on that header). + if (requestContentLength !== 0 || mustEnforceStreamBody) { + let _request = new Request(url, { + method: 'POST', + body: data, + duplex: 'half' + }); + let contentTypeHeader; + if (utils$1.isFormData(data) && (contentTypeHeader = _request.headers.get('content-type'))) { + headers.setContentType(contentTypeHeader); + } + if (_request.body) { + const [onProgress, flush] = onUploadProgress && progressEventDecorator(requestContentLength, progressEventReducer(asyncDecorator(onUploadProgress))) || []; + data = trackRequestStream(_request.body, onProgress, flush); + } } + } else if (mustEnforceStreamBody && !isRequestSupported && isReadableStreamSupported && method !== 'get' && method !== 'head') { + data = trackRequestStream(data); + } else if (mustEnforceStreamBody && isRequestSupported && !supportsRequestStream && method !== 'get' && method !== 'head') { + throw new AxiosError('Stream request bodies are not supported by the current fetch implementation', AxiosError.ERR_NOT_SUPPORT, config, request); } if (!utils$1.isString(withCredentials)) { withCredentials = withCredentials ? 'include' : 'omit'; @@ -26909,18 +28032,19 @@ const factory = env => { ...fetchOptions, signal: composedSignal, method: method.toUpperCase(), - headers: headers.normalize().toJSON(), + headers: toByteStringHeaderObject(headers.normalize()), body: data, duplex: 'half', credentials: isCredentialsSupported ? withCredentials : undefined }; request = isRequestSupported && new Request(url, resolvedOptions); let response = await (isRequestSupported ? _fetch(request, fetchOptions) : _fetch(url, resolvedOptions)); + const responseHeaders = AxiosHeaders.from(response.headers); // Cheap pre-check: if the server honestly declares a content-length that // already exceeds the cap, reject before we start streaming. if (hasMaxContentLength) { - const declaredLength = utils$1.toFiniteNumber(response.headers.get('content-length')); + const declaredLength = utils$1.toFiniteNumber(responseHeaders.getContentLength()); if (declaredLength != null && declaredLength > maxContentLength) { throw new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config, request); } @@ -26931,7 +28055,7 @@ const factory = env => { ['status', 'statusText', 'headers'].forEach(prop => { options[prop] = response[prop]; }); - const responseContentLength = utils$1.toFiniteNumber(response.headers.get('content-length')); + const responseContentLength = utils$1.toFiniteNumber(responseHeaders.getContentLength()); const [onProgress, flush] = onDownloadProgress && progressEventDecorator(responseContentLength, progressEventReducer(asyncDecorator(onDownloadProgress), true)) || []; let bytesRead = 0; const onChunkProgress = loadedBytes => { @@ -26990,13 +28114,48 @@ const factory = env => { const canceledError = composedSignal.reason; canceledError.config = config; request && (canceledError.request = request); - err !== canceledError && (canceledError.cause = err); + if (err !== canceledError) { + // Non-enumerable to match native Error `cause` semantics so loggers + // don't recurse into circular fetch internals (see #7205). + Object.defineProperty(canceledError, 'cause', { + __proto__: null, + value: err, + writable: true, + enumerable: false, + configurable: true + }); + } throw canceledError; } + + // Surface a maxBodyLength violation we raised while the request body was + // being streamed. Matching by identity (rather than reading + // `err.cause.isAxiosError`) keeps the error deterministic across runtimes + // and avoids both prototype-pollution reads and mis-attributing a foreign + // AxiosError that merely happened to land in `err.cause`. + if (pendingBodyError) { + request && !pendingBodyError.request && (pendingBodyError.request = request); + throw pendingBodyError; + } + + // Re-throw AxiosErrors we raised synchronously (data: URL / content-length + // pre-checks, response size enforcement) without re-wrapping them. + if (err instanceof AxiosError) { + request && !err.request && (err.request = request); + throw err; + } if (err && err.name === 'TypeError' && /Load failed|fetch/i.test(err.message)) { - throw Object.assign(new AxiosError('Network Error', AxiosError.ERR_NETWORK, config, request, err && err.response), { - cause: err.cause || err + const networkError = new AxiosError('Network Error', AxiosError.ERR_NETWORK, config, request, err && err.response); + // Non-enumerable to match native Error `cause` semantics so loggers + // don't recurse into circular fetch internals (see #7205). + Object.defineProperty(networkError, 'cause', { + __proto__: null, + value: err.cause || err, + writable: true, + enumerable: false, + configurable: true }); + throw networkError; } throw AxiosError.from(err, err && err.code, config, request, err && err.response); } @@ -27115,7 +28274,7 @@ function getAdapter(adapters, config) { if (!adapter) { const reasons = Object.entries(rejectedReasons).map(([id, state]) => `adapter ${id} ` + (state === false ? 'is not supported by the environment' : 'is not available in the build')); let s = length ? reasons.length > 1 ? 'since :\n' + reasons.map(renderReason).join('\n') : ' ' + renderReason(reasons[0]) : 'as no adapter specified'; - throw new AxiosError(`There is no suitable adapter to dispatch the request ` + s, 'ERR_NOT_SUPPORT'); + throw new AxiosError(`There is no suitable adapter to dispatch the request ` + s, AxiosError.ERR_NOT_SUPPORT); } return adapter; } @@ -27258,7 +28417,7 @@ validators$1.spelling = function spelling(correctSpelling) { */ function assertOptions(options, schema, allowUnknown) { - if (typeof options !== 'object') { + if (typeof options !== 'object' || options === null) { throw new AxiosError('options must be an object', AxiosError.ERR_BAD_OPTION_VALUE); } const keys = Object.keys(options); @@ -27367,7 +28526,9 @@ class Axios { silentJSONParsing: validators.transitional(validators.boolean), forcedJSONParsing: validators.transitional(validators.boolean), clarifyTimeoutError: validators.transitional(validators.boolean), - legacyInterceptorReqResOrdering: validators.transitional(validators.boolean) + legacyInterceptorReqResOrdering: validators.transitional(validators.boolean), + advertiseZstdAcceptEncoding: validators.transitional(validators.boolean), + validateStatusUndefinedResolves: validators.transitional(validators.boolean) }, false); } if (paramsSerializer != null) { @@ -27464,7 +28625,7 @@ class Axios { } getUri(config) { config = mergeConfig(this.defaults, config); - const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls); + const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls, config); return buildURL(fullPath, config.params, config.paramsSerializer); } } @@ -27476,7 +28637,7 @@ utils$1.forEach(['delete', 'get', 'head', 'options'], function forEachMethodNoDa return this.request(mergeConfig(config || {}, { method, url, - data: (config || {}).data + data: config && utils$1.hasOwnProp(config, 'data') ? config.data : undefined })); }; }); From c62f37143ce7b27dcccaa4183cfc0d18db3cf177 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 00:44:57 +0000 Subject: [PATCH 2/2] fix: apply audit fixes --- package-lock.json | 100 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 70 insertions(+), 30 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5b334dc..1318bcc 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1412,16 +1412,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": { @@ -1543,6 +1543,18 @@ "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, + "node_modules/agent-base": { + "version": "6.0.2", + "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz", + "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==", + "license": "MIT", + "dependencies": { + "debug": "4" + }, + "engines": { + "node": ">= 6.0.0" + } + }, "node_modules/ajv": { "version": "6.14.0", "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz", @@ -1637,13 +1649,14 @@ "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==" }, "node_modules/axios": { - "version": "1.16.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.0.tgz", - "integrity": "sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==", + "version": "1.18.1", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz", + "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.5", + "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, @@ -1802,9 +1815,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", "dependencies": { @@ -2088,7 +2101,6 @@ "version": "4.4.3", "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", - "dev": true, "license": "MIT", "dependencies": { "ms": "^2.1.3" @@ -2981,6 +2993,19 @@ "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==", "dev": true }, + "node_modules/https-proxy-agent": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz", + "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==", + "license": "MIT", + "dependencies": { + "agent-base": "6", + "debug": "4" + }, + "engines": { + "node": ">= 6" + } + }, "node_modules/human-signals": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz", @@ -3783,9 +3808,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { @@ -4033,7 +4058,6 @@ "version": "2.1.3", "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", - "dev": true, "license": "MIT" }, "node_modules/natural-compare": { @@ -6189,9 +6213,9 @@ "dev": true }, "brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "requires": { "balanced-match": "^4.0.2" @@ -6268,6 +6292,14 @@ "dev": true, "requires": {} }, + "agent-base": { + "version": "6.0.2", + "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz", + "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==", + "requires": { + "debug": "4" + } + }, "ajv": { "version": "6.14.0", "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz", @@ -6334,12 +6366,13 @@ "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==" }, "axios": { - "version": "1.16.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.0.tgz", - "integrity": "sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==", + "version": "1.18.1", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz", + "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==", "requires": { "follow-redirects": "^1.16.0", "form-data": "^4.0.5", + "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, @@ -6452,9 +6485,9 @@ "dev": true }, "brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "requires": { "balanced-match": "^1.0.0", @@ -6653,7 +6686,6 @@ "version": "4.4.3", "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", - "dev": true, "requires": { "ms": "^2.1.3" } @@ -7257,6 +7289,15 @@ "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==", "dev": true }, + "https-proxy-agent": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz", + "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==", + "requires": { + "agent-base": "6", + "debug": "4" + } + }, "human-signals": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz", @@ -7861,9 +7902,9 @@ "dev": true }, "js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "requires": { "argparse": "^2.0.1" @@ -8039,8 +8080,7 @@ "ms": { "version": "2.1.3", "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", - "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", - "dev": true + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==" }, "natural-compare": { "version": "1.4.0",