Repository: axios/axios
File: test/unit/regression/SNYK-JS-AXIOS-7361793.js (JavaScript)

Code before:
            res.end();
        }).listen(GOOD_PORT);
        badServer = http.createServer(function (req, res) {
            res.write('bad');
            res.end();
        }).listen(BAD_PORT);
    })

    afterEach(() => {
        goodServer.close();
        badServer.close();
    });

    it('should not fetch in server-side mode', async () => {
        const ssrfAxios = axios.create({
            baseURL: 'http://localhost:' + String(GOOD_PORT),
        });

        // Good payload would be `userId = '12345'`
        // Malicious payload is as below.
        const userId = '/localhost:' + String(BAD_PORT);

        try {
            await ssrfAxios.get(`/${userId}`);
        } catch (error) {
            assert.strictEqual(error.message, 'Invalid URL');
            return;
        }
        assert.fail('Expected an error to be thrown');
    });

    describe('should fetch in client-side mode', () => {
        let hasBrowserEnv, origin;

        before(() => {
            hasBrowserEnv = utils.hasBrowserEnv;
            origin = platform.origin;
            utils.hasBrowserEnv = true;
            platform.origin = 'http://localhost:' + String(GOOD_PORT);
        });
        after(() => {
            utils.hasBrowserEnv = hasBrowserEnv;
            platform.origin = origin;
        });
        it('should fetch in client-side mode', async () => {
            utils.hasBrowserEnv = true;
            const ssrfAxios = axios.create({
                baseURL: 'http://localhost:' + String(GOOD_PORT),
            });

            // Good payload would be `userId = '12345'`

Review comment (suggestion):
```suggestion
            assert.strictEqual(error.message, 'Invalid URL:' + userId);
```

Code after:
            res.end();
        }).listen(GOOD_PORT);
        badServer = http.createServer(function (req, res) {
            res.write('bad');
            res.end();
        }).listen(BAD_PORT);
    })

    afterEach(() => {
        goodServer.close();
        badServer.close();
    });

    it('should not fetch in server-side mode', async () => {
        const ssrfAxios = axios.create({
            baseURL: 'http://localhost:' + String(GOOD_PORT),
        });

        // Good payload would be `userId = '12345'`
        // Malicious payload is as below.
        const userId = '/localhost:' + String(BAD_PORT);

        try {
            await ssrfAxios.get(`/${userId}`);
        } catch (error) {
            assert.ok(error.message.startsWith('Invalid URL'));
            return;
        }
        assert.fail('Expected an error to be thrown');
    });

    describe('should fetch in client-side mode', () => {
        let hasBrowserEnv, origin;

        before(() => {
            hasBrowserEnv = utils.hasBrowserEnv;
            origin = platform.origin;
            utils.hasBrowserEnv = true;
            platform.origin = 'http://localhost:' + String(GOOD_PORT);
        });
        after(() => {
            utils.hasBrowserEnv = hasBrowserEnv;
            platform.origin = origin;
        });
        it('should fetch in client-side mode', async () => {
            utils.hasBrowserEnv = true;
            const ssrfAxios = axios.create({
                baseURL: 'http://localhost:' + String(GOOD_PORT),
            });

            // Good payload would be `userId = '12345'`