Fix regular expressions in isValidXss

[ZeroCho]

Fix for #2670
following XSS Cheatsheet
also fixed JavaScript string problem in #2646 #2663 only preventing "javascript:"

It's impossible for current simple regex to prevent all kind of XSS attacks. But I tried to prevent most frequent & famous events for attacking, without saying no to "only=true"'.

My opinion is, although it is good to prevent XSS by checking URL, normal users should not suffer from this function. Current regex is still too loose.

[ZeroCho]

separated into two regex for readablity

[Kolobok12309]

You forgot touch events

[ZeroCho]

@Kolobok12309 Good point. Between huge amounts of events, I just want to add serious and frequently used events first. Touch series should be included

[Kolobok12309]

Flags only in xssJsRegexp, onMouseMove= is dismatched by xssEventRegexp
And only now find, <script> equal <\script>

P.S. Thanks for this PR:D

[yasuf]

thanks @ZeroCho appreciate the highly requested fix

[ZeroCho]

@Kolobok12309 Fixed case insensitive issue
Can you please explain <script> equal <\script> in detail?

[Kolobok12309]

@ZeroCho Sorry, i'm stupid, i test it in console and forget js ignoring useless guarding))

Thanks for PR again

[ZeroCho]

@yasuf Please tell me, if something more have to be changed or improved!

[chinesedfan]

Thanks for your fix. But my opinion is the same with #2447 (comment).

XSS check is out of the scope of axios, and regular expressions can't find every possible case, i.e. using encoding. The most important problem is that it's overkill. I recommend to simply revert corresponding commit, as well as removing isValidXss.

[chinesedfan]

Closed in favor of #2679. Thanks to @ZeroCho all the same.