<p dir="auto"><strong>Describe the bug</strong><br>
When set url:</p>
<ol dir="auto">
<li>
<p dir="auto"><a href="https://localhost:44302/api/v1/contract?order%5B0%5D.ascendant=false&amp;order%5B0%5D.name=id&amp;pagging.page=0&amp;pagging.pageSize=9&amp;filter.code9=222&amp;filter.onlyAgency=true" rel="nofollow">https://localhost:44302/api/v1/contract?order%5B0%5D.ascendant=false&amp;order%5B0%5D.name=id&amp;pagging.page=0&amp;pagging.pageSize=9&amp;filter.code9=222&amp;filter.onlyAgency=true</a></p>
</li>
<li>
<p dir="auto"><a href="https://localhost:44302/api/v1/contract?code9=222&amp;onlyAgency=true" rel="nofollow">https://localhost:44302/api/v1/contract?code9=222&amp;onlyAgency=true</a></p>
</li>
</ol>
<p dir="auto">Fail function isValidXss<br>
line: 1464                    var xssRegex = /(\b)(on\w+)=|javascript|(&lt;\s*)(/*)script/gi;</p>
<p dir="auto"><strong>To Reproduce</strong><br>
Open devTools (F12) in chrome</p>
<div class="highlight highlight-source-js notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="var xssRegex = /(\b)(on\w+)=|javascript|(&lt;\s*)(\/*)script/gi;
xssRegex.test('https://localhost:44302/api/v1/contract?code9=222&amp;onlyAgency=true')"><pre class="notranslate"><span class="pl-k">var</span> <span class="pl-s1">xssRegex</span> <span class="pl-c1">=</span> <span class="pl-pds"><span class="pl-c1">/</span><span class="pl-kos">(</span><span class="pl-cce">\b</span><span class="pl-kos">)</span><span class="pl-kos">(</span>on<span class="pl-cce">\w</span><span class="pl-c1">+</span><span class="pl-kos">)</span>=<span class="pl-c1">|</span>javascript<span class="pl-c1">|</span><span class="pl-kos">(</span>&lt;<span class="pl-cce">\s</span><span class="pl-c1">*</span><span class="pl-kos">)</span><span class="pl-kos">(</span><span class="pl-cce">\/</span><span class="pl-c1">*</span><span class="pl-kos">)</span>script<span class="pl-c1">/</span>gi</span><span class="pl-kos">;</span>
<span class="pl-s1">xssRegex</span><span class="pl-kos">.</span><span class="pl-en">test</span><span class="pl-kos">(</span><span class="pl-s">'https://localhost:44302/api/v1/contract?code9=222&amp;onlyAgency=true'</span><span class="pl-kos">)</span></pre></div>
<p dir="auto"><strong>Expected behavior</strong><br>
must print false</p>
<p dir="auto"><strong>Solution</strong><br>
Fix regular expression</p>
<p dir="auto"><strong>Environment:</strong></p>
<ul dir="auto">
<li>Axios Version: 0.19.1</li>
<li>OS: Windows</li>
<li>Browser: Chrome</li>
<li>Browser Version: 79</li>
<li>Additional Library Versions: React 16.12</li>
</ul>
<p dir="auto">It seems that axios v0.19.1 introduced a new bug.</p>
<p dir="auto">The bug comes from <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="506498428" data-permission-text="Title is private" data-url="https://github.com/axios/axios/issues/2464" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/2464/hovercard" href="https://github.com/axios/axios/pull/2464">#2464</a></p>
<p dir="auto">All urls containing <code class="notranslate">javascript</code>keyword is throwing XSS error.  So, all following urls cannot be used in axios any more:</p>
<ul dir="auto">
<li><a href="https://www.javascript.com" rel="nofollow">https://www.javascript.com</a></li>
<li><a href="https://stackoverflow.com/questions/tagged/javascript" rel="nofollow">https://stackoverflow.com/questions/tagged/javascript</a></li>
<li><a href="https://www.google.com/search?q=javascript" rel="nofollow">https://www.google.com/search?q=javascript</a></li>
</ul>
<p dir="auto">Here is a link to regexp: <a href="https://regexr.com/4rsst" rel="nofollow">https://regexr.com/4rsst</a></p>
<p dir="auto">Expected behavior: axios should accept <code class="notranslate">javascript</code> in urls</p>