Summary

• add bounded depth checks for form serialization helpers
• use own-property reads for nested request options that affect auth, params, and proxy handling
• add regression coverage for config cloning, local proxy bypass, and serializer edge cases

Testing

• ./node_modules/.bin/grunt eslint
• ./node_modules/.bin/grunt mochaTest
• npm run build
• PATH="./node_modules/.bin:$PATH" node bin/ssl_hotfix.js ./node_modules/.bin/dtslint --localTs node_modules/typescript/lib

Note

• Karma was attempted but could not run locally because FirefoxHeadless is unavailable and FIREFOX_BIN is unset.

Summary by cubic

Hardened request config handling and form serialization. We now ignore inherited options, cap form depth, normalize blank Basic Auth credentials, and treat 0.0.0.0 as local for proxy bypass.

Description

• Summary of changes
  • Use own-property reads for auth, paramsSerializer, proxy, and data in HTTP/XHR adapters and alias methods.
  • Normalize null/undefined Basic Auth credentials to empty strings in both adapters.
  • Add bounded depth checks to toFormData and formDataToJSON; throw AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED.
  • Update buildURL to accept a function or options object; ignore inherited encode/serialize.
  • Treat 0.0.0.0 as loopback in shouldBypassProxy.
• Reasoning
  • Block prototype pollution from injecting credentials, params, or proxy settings.
  • Prevent crashes/DoS from overly deep or cyclic structures during form serialization.
  • Ensure consistent Authorization header when credentials are blank.
  • Fix proxy bypass for local addresses.
• Additional context
  • Regression tests added for config cloning, nullish auth, local proxy bypass, and serializer edge cases.

Docs

• Document form serialization depth limits and the new ERR_FORM_DATA_DEPTH_EXCEEDED.
• Clarify paramsSerializer can be a function or an options object.
• Note that auth.username/auth.password default to empty strings when nullish.
• Note that 0.0.0.0 is treated as local in no_proxy matching.

Testing

• Added/updated tests:
  • test/specs/__helpers.js: normalize nullish Basic Auth in XHR.
  • test/unit/adapters/http.js: nullish Basic Auth, no inherited auth/proxy/paramsSerializer after cloning, 0.0.0.0 bypass.
  • test/unit/core/prototypePollution.js: alias methods don’t inherit data.
  • test/unit/helpers/buildURL.js: ignore inherited serializer options.
  • test/unit/helpers/formDataToJSON.js: depth limit and basic conversion.
  • test/unit/helpers/shouldBypassProxy.js: 0.0.0.0 bypass behavior and port matching.
  • test/unit/helpers/toFormData.js: depth limit including meta-token paths.
• Local runs: eslint, mocha, build, and type checks passed; rely on CI for Karma.

Semantic version impact

Patch: bug fixes and hardening with no API changes. The new error only triggers on excessive depth; Basic Auth normalization aligns with expected behavior.

^{Written for commit 04586c5. Summary will update on new commits.}