<p dir="auto"><strong>Describe the issue</strong><br>
I was curious as to why the regex looks for 'on' in the get parameters. I had a parameter called 'onSiteTestComplete=false' but I had to change it to 'isOnSiteTestComplete=false'. Thanks!</p>
<p dir="auto"><a href="https://github.com/axios/axios/blob/master/lib/helpers/isValidXss.js">https://github.com/axios/axios/blob/master/lib/helpers/isValidXss.js</a></p>
<p dir="auto"><strong>Environment:</strong></p>
<ul dir="auto">
<li>Axios Version 0.19.0</li>
<li>OS: OSX 10.15.2 Catlina</li>
<li>Browser Chrome Version 79.0.3945.117 (Official Build) (64-bit)</li>
</ul>
<p dir="auto">It seems that axios v0.19.1 introduced a new bug.</p>
<p dir="auto">The bug comes from <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="506498428" data-permission-text="Title is private" data-url="https://github.com/axios/axios/issues/2464" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/2464/hovercard" href="https://github.com/axios/axios/pull/2464">#2464</a></p>
<p dir="auto">All urls containing <code class="notranslate">javascript</code>keyword is throwing XSS error.  So, all following urls cannot be used in axios any more:</p>
<ul dir="auto">
<li><a href="https://www.javascript.com" rel="nofollow">https://www.javascript.com</a></li>
<li><a href="https://stackoverflow.com/questions/tagged/javascript" rel="nofollow">https://stackoverflow.com/questions/tagged/javascript</a></li>
<li><a href="https://www.google.com/search?q=javascript" rel="nofollow">https://www.google.com/search?q=javascript</a></li>
</ul>
<p dir="auto">Here is a link to regexp: <a href="https://regexr.com/4rsst" rel="nofollow">https://regexr.com/4rsst</a></p>
<p dir="auto">Expected behavior: axios should accept <code class="notranslate">javascript</code> in urls</p>