It seems that axios v0.19.1 introduced a new bug. 

The bug comes from https://github.com/axios/axios/pull/2464

All urls containing `javascript`keyword is throwing XSS error.  So, all following urls cannot be used in axios any more:

- https://www.javascript.com
- https://stackoverflow.com/questions/tagged/javascript
- https://www.google.com/search?q=javascript

Here is a link to regexp: https://regexr.com/4rsst

Expected behavior: axios should accept `javascript` in urls
test/specs/helpers/isURLSameOrigin.spec.js
var isURLSameOrigin = require('../../../lib/helpers/isURLSameOrigin');
describe('helpers::isURLSameOrigin', function () {
  it('should detect same origin', function () {
    expect(isURLSameOrigin(window.location.href)).toEqual(true);
  });
  it('should detect different origin', function () {
    expect(isURLSameOrigin('https://github.com/axios/axios')).toEqual(false);
  });
  it('should detect XSS scripts on a same origin request', function () {
    expect(function() {
      isURLSameOrigin('https://github.com/axios/axios?<script>alert("hello")</script>');
    }).toThrowError(Error, 'URL contains XSS injection attempt')
  });  
});