Open
Conversation
Author
|
@DavertMik could you review this PR? I am not able to assign reviewers to it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation/Description of the PR
Security Fix: Axios NO_PROXY Bypass → SSRF Risk
This PR addresses a known vulnerability in Axios where hostname normalization is not handled correctly during
NO_PROXYevaluation.Issue
Axios performs a literal string comparison when matching
NO_PROXYrules, without normalizing hostnames.This allows specially crafted hostnames such as:
localhost.(trailing dot)[::1](IPv6 literal)to bypass
NO_PROXYrules and be routed through a configured proxy.Impact
This breaks expected behavior where
localhost,127.0.0.1, and::1should always bypass proxies.Root Cause
Per RFC standards, hostnames like
localhost.are equivalent tolocalhost, but Axios does not normalize them before comparison, resulting in incorrect proxy routing.Resolution
1.15.0)NO_PROXYmatchingReferences
Summary: Fixes a critical SSRF vector caused by improper
NO_PROXYhandling in Axios by upgrading to a secure version.Applicable helpers:
Applicable plugins:
Type of change
Checklist:
npm run docs)npm run lint)npm test)