File size: 2,899 Bytes
1116189 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 | 'use strict';
import AxiosError, { REDACTED } from './AxiosError.js';
import isAbsoluteURL from '../helpers/isAbsoluteURL.js';
import combineURLs from '../helpers/combineURLs.js';
import normalizeURLForProtocolCheck from '../helpers/normalizeURLForProtocolCheck.js';
const malformedHttpProtocol = /^https?:(?!\/\/)/i;
// Redact the parts of a URL that can carry secrets before it is embedded in an
// error message. AxiosError.toJSON() serializes `message` verbatim and errors
// are commonly logged, while the opt-in `config.redact` model only cleans
// config keys — it cannot reach the message. Redact only the genuinely
// sensitive substrings — userinfo (credentials), query parameter values and
// fragment contents — with the same REDACTED marker the config redaction uses,
// while keeping the scheme, host, path and parameter names so the offending
// request stays accurately identifiable.
function redactFragment(fragment) {
if (!fragment) {
return fragment;
}
return fragment.replace(/(^|&)([^=&]*=)?[^&]+/g, (match, separator, parameterName = '') => {
return `${separator}${parameterName}${REDACTED}`;
});
}
function redactSensitiveURLParts(url) {
const redactedURL = url.replace(/^(https?:\/{0,2})[^/?#]*@/i, `$1${REDACTED}@`);
const fragmentIndex = redactedURL.indexOf('#');
const urlWithoutFragment =
fragmentIndex === -1 ? redactedURL : redactedURL.slice(0, fragmentIndex);
const redactedURLWithoutFragment = urlWithoutFragment.replace(
/([?&][^=&#]*=)[^&#]*/g,
`$1${REDACTED}`
);
if (fragmentIndex === -1) {
return redactedURLWithoutFragment;
}
return `${redactedURLWithoutFragment}#${redactFragment(redactedURL.slice(fragmentIndex + 1))}`;
}
function assertValidHttpProtocolURL(url, config) {
if (typeof url === 'string') {
const normalizedURL = normalizeURLForProtocolCheck(url);
if (malformedHttpProtocol.test(normalizedURL)) {
throw new AxiosError(
`Invalid URL ${JSON.stringify(redactSensitiveURLParts(normalizedURL))}: missing "//" after protocol`,
AxiosError.ERR_INVALID_URL,
config
);
}
}
}
/**
* Creates a new URL by combining the baseURL with the requestedURL,
* only when the requestedURL is not already an absolute URL.
* If the requestURL is absolute, this function returns the requestedURL untouched.
*
* @param {string} baseURL The base URL
* @param {string} requestedURL Absolute or relative URL to combine
*
* @returns {string} The combined full path
*/
export default function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls, config) {
assertValidHttpProtocolURL(requestedURL, config);
let isRelativeUrl = !isAbsoluteURL(requestedURL);
if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
assertValidHttpProtocolURL(baseURL, config);
return combineURLs(baseURL, requestedURL);
}
return requestedURL;
}
|