isValidXss helper works incorrectly

[mspiderv]

Describe the bug
Function isValidXss works incorrectly.

To Reproduce

// I just copy & paste the function declaration
function isValidXss(requestURL) {
  var xssRegex = /(\b)(on\w+)=|javascript|(<\s*)(\/*)script/gi;
  return xssRegex.test(requestURL);
};

// Calling this will result in `true`
isValidXss('https://www.somedomain.com?only=true')

Expected behavior
I expect the previous function call to result in false. I see no XSS attack in there.

Environment:

• Axios Version 0.19.1

[Larsrdev]

Yea sir you are right! I also saw this yesterday. We now have problems with some URL params like this:

files=&names=&onlyMarkedOnes=false&batchSize=20&offset=0

Im not deep into XSS. Why is there the "(on\S+)" in the regex?

[Larsrdev]

#2663

#2646

#2645

[chinesedfan]

Duplicate of #2646.