It seems that axios v0.19.1 introduced a new bug. 

The bug comes from https://github.com/axios/axios/pull/2464

All urls containing `javascript`keyword is throwing XSS error.  So, all following urls cannot be used in axios any more:

- https://www.javascript.com
- https://stackoverflow.com/questions/tagged/javascript
- https://www.google.com/search?q=javascript

Here is a link to regexp: https://regexr.com/4rsst

Expected behavior: axios should accept `javascript` in urls
lib/helpers/isURLSameOrigin.js
var href = url;
        if (isValidXss(url)) {
          throw new Error('URL contains XSS injection attempt');
        }
        if (msie) {
        
          urlParsingNode.setAttribute('href', href);
          href = urlParsingNode.href;
        }
        urlParsingNode.setAttribute('href', href);
        
        return {
          href: urlParsingNode.href,
          protocol: urlParsingNode.protocol ? urlParsingNode.protocol.replace(/:$/, '') : '',
          host: urlParsingNode.host,