<p dir="auto"><strong>Describe the bug</strong><br>
applying a query string parameter ("onlyApproved=true" in this instance), is throwing <code class="notranslate">URL contains XSS injection attempt</code>.</p>
<p dir="auto"><strong>To Reproduce</strong><br>
perform an <code class="notranslate">axios.get</code> request (not tried any other methods) with any query string parameter beginning with <code class="notranslate">on</code>.</p>
<div class="highlight highlight-source-js notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="https://randomdomain.com/api/endpoint?onlyRandomThings=true"><pre class="notranslate">https:<span class="pl-c">//randomdomain.com/api/endpoint?onlyRandomThings=true</span><span class="pl-kos"></span></pre></div>
<p dir="auto"><strong>Expected behavior</strong><br>
This should not be caught as valid XSS.</p>
<p dir="auto"><strong>Environment:</strong></p>
<ul dir="auto">
<li>Axios Version [0.19.1]</li>
<li>OS: [Windows 10 Professional]</li>
<li>Browser [all]</li>
<li>Browser Version [all]</li>
<li>Additional Library Versions [React 16.12]</li>
</ul>
<p dir="auto">It seems that axios v0.19.1 introduced a new bug.</p>
<p dir="auto">The bug comes from <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="506498428" data-permission-text="Title is private" data-url="https://github.com/axios/axios/issues/2464" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/2464/hovercard" href="https://github.com/axios/axios/pull/2464">#2464</a></p>
<p dir="auto">All urls containing <code class="notranslate">javascript</code>keyword is throwing XSS error.  So, all following urls cannot be used in axios any more:</p>
<ul dir="auto">
<li><a href="https://www.javascript.com" rel="nofollow">https://www.javascript.com</a></li>
<li><a href="https://stackoverflow.com/questions/tagged/javascript" rel="nofollow">https://stackoverflow.com/questions/tagged/javascript</a></li>
<li><a href="https://www.google.com/search?q=javascript" rel="nofollow">https://www.google.com/search?q=javascript</a></li>
</ul>
<p dir="auto">Here is a link to regexp: <a href="https://regexr.com/4rsst" rel="nofollow">https://regexr.com/4rsst</a></p>
<p dir="auto">Expected behavior: axios should accept <code class="notranslate">javascript</code> in urls</p>