<p dir="auto"><strong>Describe the bug</strong><br>
Function <a href="https://github.com/axios/axios/blob/master/lib/helpers/isValidXss.js"><code class="notranslate">isValidXss</code></a> works incorrectly.</p>
<p dir="auto"><strong>To Reproduce</strong></p>
<div class="highlight highlight-source-js notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="// I just copy &amp; paste the function declaration
function isValidXss(requestURL) {
  var xssRegex = /(\b)(on\w+)=|javascript|(&lt;\s*)(\/*)script/gi;
  return xssRegex.test(requestURL);
};

// Calling this will result in `true`
isValidXss('https://www.somedomain.com?only=true')"><pre class="notranslate"><span class="pl-c">// I just copy &amp; paste the function declaration</span>
<span class="pl-k">function</span> <span class="pl-en">isValidXss</span><span class="pl-kos">(</span><span class="pl-s1">requestURL</span><span class="pl-kos">)</span> <span class="pl-kos">{</span>
  <span class="pl-k">var</span> <span class="pl-s1">xssRegex</span> <span class="pl-c1">=</span> <span class="pl-pds"><span class="pl-c1">/</span><span class="pl-kos">(</span><span class="pl-cce">\b</span><span class="pl-kos">)</span><span class="pl-kos">(</span>on<span class="pl-cce">\w</span><span class="pl-c1">+</span><span class="pl-kos">)</span>=<span class="pl-c1">|</span>javascript<span class="pl-c1">|</span><span class="pl-kos">(</span>&lt;<span class="pl-cce">\s</span><span class="pl-c1">*</span><span class="pl-kos">)</span><span class="pl-kos">(</span><span class="pl-cce">\/</span><span class="pl-c1">*</span><span class="pl-kos">)</span>script<span class="pl-c1">/</span>gi</span><span class="pl-kos">;</span>
  <span class="pl-k">return</span> <span class="pl-s1">xssRegex</span><span class="pl-kos">.</span><span class="pl-en">test</span><span class="pl-kos">(</span><span class="pl-s1">requestURL</span><span class="pl-kos">)</span><span class="pl-kos">;</span>
<span class="pl-kos">}</span><span class="pl-kos">;</span>

<span class="pl-c">// Calling this will result in `true`</span>
<span class="pl-en">isValidXss</span><span class="pl-kos">(</span><span class="pl-s">'https://www.somedomain.com?only=true'</span><span class="pl-kos">)</span></pre></div>
<p dir="auto"><strong>Expected behavior</strong><br>
I expect the previous function call to result in false. I see no XSS attack in there.</p>
<p dir="auto"><strong>Environment:</strong></p>
<ul dir="auto">
<li>Axios Version 0.19.1</li>
</ul>
<p dir="auto">It seems that axios v0.19.1 introduced a new bug.</p>
<p dir="auto">The bug comes from <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="506498428" data-permission-text="Title is private" data-url="https://github.com/axios/axios/issues/2464" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/2464/hovercard" href="https://github.com/axios/axios/pull/2464">#2464</a></p>
<p dir="auto">All urls containing <code class="notranslate">javascript</code>keyword is throwing XSS error.  So, all following urls cannot be used in axios any more:</p>
<ul dir="auto">
<li><a href="https://www.javascript.com" rel="nofollow">https://www.javascript.com</a></li>
<li><a href="https://stackoverflow.com/questions/tagged/javascript" rel="nofollow">https://stackoverflow.com/questions/tagged/javascript</a></li>
<li><a href="https://www.google.com/search?q=javascript" rel="nofollow">https://www.google.com/search?q=javascript</a></li>
</ul>
<p dir="auto">Here is a link to regexp: <a href="https://regexr.com/4rsst" rel="nofollow">https://regexr.com/4rsst</a></p>
<p dir="auto">Expected behavior: axios should accept <code class="notranslate">javascript</code> in urls</p>