Describe the bug
Starting from Axios v1.8.0, the allowAbsoluteUrls attribute was introduced in the configuration to control the use of absolute URLs. (PR: #6795)
Currently, this parameter is being ignored in the buildFullPath call from the HTTP adapter.
|
const fullPath = buildFullPath(config.baseURL, config.url); |
This oversight means that it is still possible to make requests to absolute URLs even when the allowAbsoluteUrls configuration attribute is set to false.
Proof of Concept:
Even though getUri returns a URL from example.com, the request is sent to evil.com
> const axios = require('axios');
> axios.VERSION
'1.8.1'
> const client = axios.create({baseURL: 'http://example.com/', allowAbsoluteUrls: false});
> client.getUri({url: 'http://evil.com'});
'http://example.com/http://evil.com'
> client.get('http://evil.com');Solution:
Include the allowAbsoluteUrls parameter in the call to the buildFullPath function.
|
const fullPath = buildFullPath(config.baseURL, config.url); |
const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls);
To Reproduce
No response
Code snippet
const axios = require('axios');
const client = axios.create({baseURL: 'http://example.com/', allowAbsoluteUrls: false});
client.get('http://evil.com');Expected behavior
The request should be to example.com
Axios Version
1.8.0
Adapter Version
http
Browser
No response
Browser Version
No response
Node.js Version
22.12.0
OS
Debian 5.10.226-1
Additional Library Versions
Additional context/Screenshots
Describe the bug
Starting from Axios v1.8.0, the
allowAbsoluteUrlsattribute was introduced in the configuration to control the use of absolute URLs. (PR: #6795)Currently, this parameter is being ignored in the
buildFullPathcall from the HTTP adapter.axios/lib/adapters/http.js
Line 231 in 72acf75
This oversight means that it is still possible to make requests to absolute URLs even when the
allowAbsoluteUrlsconfiguration attribute is set tofalse.Proof of Concept:
Even though
getUrireturns a URL fromexample.com, the request is sent toevil.comSolution:
Include the
allowAbsoluteUrlsparameter in the call to thebuildFullPathfunction.axios/lib/adapters/http.js
Line 231 in 72acf75
To Reproduce
No response
Code snippet
Expected behavior
The request should be to example.com
Axios Version
1.8.0
Adapter Version
http
Browser
No response
Browser Version
No response
Node.js Version
22.12.0
OS
Debian 5.10.226-1
Additional Library Versions
Additional context/Screenshots