/proc/self/root/var/runtime/node_modules/@aws-sdk/node_modules/axios/lib/helpers
This explorer reads the filesystem of the server it runs on, so /workspace/user isn't present here. Browsing and the terminal still work against this server's own disk from /.
import platform from '../platform/index.js';import utils from '../utils.js';import isURLSameOrigin from './isURLSameOrigin.js';import cookies from './cookies.js';import buildFullPath from '../core/buildFullPath.js';import mergeConfig from '../core/mergeConfig.js';import AxiosHeaders from '../core/AxiosHeaders.js';import buildURL from './buildURL.js'; export default (config) => { const newConfig = mergeConfig({}, config); // Read only own properties to prevent prototype pollution gadgets // (e.g. Object.prototype.baseURL = 'https://evil.com'). See GHSA-q8qp-cvcw-x6jj. const own = (key) => (utils.hasOwnProp(newConfig, key) ? newConfig[key] : undefined); const data = own('data'); let withXSRFToken = own('withXSRFToken'); const xsrfHeaderName = own('xsrfHeaderName'); const xsrfCookieName = own('xsrfCookieName'); let headers = own('headers'); const auth = own('auth'); const baseURL = own('baseURL'); const allowAbsoluteUrls = own('allowAbsoluteUrls'); const url = own('url'); newConfig.headers = headers = AxiosHeaders.from(headers); newConfig.url = buildURL( buildFullPath(baseURL, url, allowAbsoluteUrls), config.params, config.paramsSerializer ); // HTTP basic authentication if (auth) { headers.set( 'Authorization', 'Basic ' + btoa( (auth.username || '') + ':' + (auth.password ? unescape(encodeURIComponent(auth.password)) : '') ) ); } if (utils.isFormData(data)) { if (platform.hasStandardBrowserEnv || platform.hasStandardBrowserWebWorkerEnv) { headers.setContentType(undefined); // browser handles it } else if (utils.isFunction(data.getHeaders)) { // Node.js FormData (like form-data package) const formHeaders = data.getHeaders(); // Only set safe headers to avoid overwriting security headers const allowedHeaders = ['content-type', 'content-length']; Object.entries(formHeaders).forEach(([key, val]) => { if (allowedHeaders.includes(key.toLowerCase())) { headers.set(key, val); } }); } } // Add xsrf header // This is only done if running in a standard browser environment. // Specifically not if we're in a web worker, or react-native. if (platform.hasStandardBrowserEnv) { if (utils.isFunction(withXSRFToken)) { withXSRFToken = withXSRFToken(newConfig); } // Strict boolean check — prevents proto-pollution gadgets (e.g. Object.prototype.withXSRFToken = 1) // and misconfigurations (e.g. "false") from short-circuiting the same-origin check and leaking // the XSRF token cross-origin. See GHSA-xx6v-rp6x-q39c. const shouldSendXSRF = withXSRFToken === true || (withXSRFToken == null && isURLSameOrigin(newConfig.url)); if (shouldSendXSRF) { const xsrfValue = xsrfHeaderName && xsrfCookieName && cookies.read(xsrfCookieName); if (xsrfValue) { headers.set(xsrfHeaderName, xsrfValue); } } } return newConfig;};