File Explorer

1'use strict';2 3import AxiosError, { REDACTED } from './AxiosError.js';4import isAbsoluteURL from '../helpers/isAbsoluteURL.js';5import combineURLs from '../helpers/combineURLs.js';6 7const malformedHttpProtocol = /^https?:(?!\/\/)/i;8const httpProtocolControlCharacters = /[\t\n\r]/g;9 10function stripLeadingC0ControlOrSpace(url) {11  let i = 0;12  while (i < url.length && url.charCodeAt(i) <= 0x20) {13    i++;14  }15  return url.slice(i);16}17 18function normalizeURLForProtocolCheck(url) {19  return stripLeadingC0ControlOrSpace(url).replace(httpProtocolControlCharacters, '');20}21 22// Redact the parts of a URL that can carry secrets before it is embedded in an23// error message. AxiosError.toJSON() serializes `message` verbatim and errors24// are commonly logged, while the opt-in `config.redact` model only cleans25// config keys — it cannot reach the message. Redact only the genuinely26// sensitive substrings — userinfo (credentials), query parameter values and27// fragment contents — with the same REDACTED marker the config redaction uses,28// while keeping the scheme, host, path and parameter names so the offending29// request stays accurately identifiable.30function redactFragment(fragment) {31  if (!fragment) {32    return fragment;33  }34 35  return fragment.replace(/(^|&)([^=&]*=)?[^&]+/g, (match, separator, parameterName = '') => {36    return `${separator}${parameterName}${REDACTED}`;37  });38}39 40function redactSensitiveURLParts(url) {41  const redactedURL = url.replace(/^(https?:\/{0,2})[^/?#]*@/i, `$1${REDACTED}@`);42  const fragmentIndex = redactedURL.indexOf('#');43  const urlWithoutFragment =44    fragmentIndex === -1 ? redactedURL : redactedURL.slice(0, fragmentIndex);45  const redactedURLWithoutFragment = urlWithoutFragment.replace(46    /([?&][^=&#]*=)[^&#]*/g,47    `$1${REDACTED}`48  );49 50  if (fragmentIndex === -1) {51    return redactedURLWithoutFragment;52  }53 54  return `${redactedURLWithoutFragment}#${redactFragment(redactedURL.slice(fragmentIndex + 1))}`;55}56 57function assertValidHttpProtocolURL(url, config) {58  if (typeof url === 'string') {59    const normalizedURL = normalizeURLForProtocolCheck(url);60    if (malformedHttpProtocol.test(normalizedURL)) {61      throw new AxiosError(62        `Invalid URL ${JSON.stringify(redactSensitiveURLParts(normalizedURL))}: missing "//" after protocol`,63        AxiosError.ERR_INVALID_URL,64        config65      );66    }67  }68}69 70/**71 * Creates a new URL by combining the baseURL with the requestedURL,72 * only when the requestedURL is not already an absolute URL.73 * If the requestURL is absolute, this function returns the requestedURL untouched.74 *75 * @param {string} baseURL The base URL76 * @param {string} requestedURL Absolute or relative URL to combine77 *78 * @returns {string} The combined full path79 */80export default function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls, config) {81  assertValidHttpProtocolURL(requestedURL, config);82  let isRelativeUrl = !isAbsoluteURL(requestedURL);83  if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {84    assertValidHttpProtocolURL(baseURL, config);85    return combineURLs(baseURL, requestedURL);86  }87  return requestedURL;88}89