<p dir="auto"><strong>Describe the bug</strong></p>
<p dir="auto">In the file 【axios/lib/core/mergeConfig.js】. the 'url ' has existed in 'valueFromConfig2Keys' and 'defaultToConfig2Keys'</p>
<p dir="auto">By the way, I think the 'params' shoud exist in 'valueFromConfig2Keys'  BUT NOT IN 'mergeDeepPropertiesKeys'</p>
<div class="highlight highlight-source-js notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="var valueFromConfig2Keys = ['url', 'method', 'data'];
var mergeDeepPropertiesKeys = ['headers', 'auth', 'proxy', 'params'];
var defaultToConfig2Keys = [
    'baseURL', 'url', 'transformRequest', 'transformResponse', 'paramsSerializer',
    'timeout', 'withCredentials', 'adapter', 'responseType', 'xsrfCookieName',
    'xsrfHeaderName', 'onUploadProgress', 'onDownloadProgress',
    'maxContentLength', 'maxBodyLength', 'validateStatus', 'maxRedirects', 'httpAgent',
    'httpsAgent', 'cancelToken', 'socketPath', 'responseEncoding'
];"><pre class="notranslate"><span class="pl-k">var</span> <span class="pl-s1">valueFromConfig2Keys</span> <span class="pl-c1">=</span> <span class="pl-kos">[</span><span class="pl-s">'url'</span><span class="pl-kos">,</span> <span class="pl-s">'method'</span><span class="pl-kos">,</span> <span class="pl-s">'data'</span><span class="pl-kos">]</span><span class="pl-kos">;</span>
<span class="pl-k">var</span> <span class="pl-s1">mergeDeepPropertiesKeys</span> <span class="pl-c1">=</span> <span class="pl-kos">[</span><span class="pl-s">'headers'</span><span class="pl-kos">,</span> <span class="pl-s">'auth'</span><span class="pl-kos">,</span> <span class="pl-s">'proxy'</span><span class="pl-kos">,</span> <span class="pl-s">'params'</span><span class="pl-kos">]</span><span class="pl-kos">;</span>
<span class="pl-k">var</span> <span class="pl-s1">defaultToConfig2Keys</span> <span class="pl-c1">=</span> <span class="pl-kos">[</span>
    <span class="pl-s">'baseURL'</span><span class="pl-kos">,</span> <span class="pl-s">'url'</span><span class="pl-kos">,</span> <span class="pl-s">'transformRequest'</span><span class="pl-kos">,</span> <span class="pl-s">'transformResponse'</span><span class="pl-kos">,</span> <span class="pl-s">'paramsSerializer'</span><span class="pl-kos">,</span>
    <span class="pl-s">'timeout'</span><span class="pl-kos">,</span> <span class="pl-s">'withCredentials'</span><span class="pl-kos">,</span> <span class="pl-s">'adapter'</span><span class="pl-kos">,</span> <span class="pl-s">'responseType'</span><span class="pl-kos">,</span> <span class="pl-s">'xsrfCookieName'</span><span class="pl-kos">,</span>
    <span class="pl-s">'xsrfHeaderName'</span><span class="pl-kos">,</span> <span class="pl-s">'onUploadProgress'</span><span class="pl-kos">,</span> <span class="pl-s">'onDownloadProgress'</span><span class="pl-kos">,</span>
    <span class="pl-s">'maxContentLength'</span><span class="pl-kos">,</span> <span class="pl-s">'maxBodyLength'</span><span class="pl-kos">,</span> <span class="pl-s">'validateStatus'</span><span class="pl-kos">,</span> <span class="pl-s">'maxRedirects'</span><span class="pl-kos">,</span> <span class="pl-s">'httpAgent'</span><span class="pl-kos">,</span>
    <span class="pl-s">'httpsAgent'</span><span class="pl-kos">,</span> <span class="pl-s">'cancelToken'</span><span class="pl-kos">,</span> <span class="pl-s">'socketPath'</span><span class="pl-kos">,</span> <span class="pl-s">'responseEncoding'</span>
<span class="pl-kos">]</span><span class="pl-kos">;</span></pre></div>
<h4 dir="auto">Describe the bug</h4>
<p dir="auto">Axios depends on follow-redirects version 1.14.4.</p>
<p dir="auto">There's a CVE that allows cookie exposure through redirects (described <a href="https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/" rel="nofollow">here</a>). This CVE was fixed in follow-redirects v1.14.17.</p>
<h4 dir="auto">To Reproduce</h4>
<p dir="auto">Run a vulnerability scan</p>
<h4 dir="auto">Expected behavior</h4>
<p dir="auto">Depend on follow-redirects v1.14.17 or later.</p>
<h4 dir="auto">Environment</h4>
<h4 dir="auto">Additional context/Screenshots</h4>
<p dir="auto">Related: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1095413168" data-permission-text="Title is private" data-url="https://github.com/follow-redirects/follow-redirects/issues/183" data-hovercard-type="issue" data-hovercard-url="/follow-redirects/follow-redirects/issues/183/hovercard" href="https://github.com/follow-redirects/follow-redirects/issues/183">follow-redirects/follow-redirects#183</a></p>