@@ -283,6 +283,20 @@ const installFetchPatches = ({
283283 headers : { 'Content-Type' : 'text/plain' }
284284 } ) ;
285285 } ;
286+ const oldImportScripts = globalThis . importScripts ;
287+ globalThis . importScripts = ( ...args ) => {
288+ const newargs = args . map ( url => {
289+ const urlObj = new URL ( url , location . href ) ;
290+ if ( allowedOrigins . includes ( urlObj . origin ) ) {
291+ return url ;
292+ }
293+ if ( proxySites && proxySites . includes ( urlObj . origin ) ) {
294+ return proxyURL + urlObj . hostname + urlObj . pathname ;
295+ }
296+ throw new Error ( 'Script is from blocked URL' ) ;
297+ } ) ;
298+ return oldImportScripts ( ...newargs ) ;
299+ } ;
286300 const oldWorker = Worker ;
287301 const NewWorker = function (
288302 script : string | URL ,
@@ -339,6 +353,20 @@ const installFetchPatches = ({
339353 headers: { 'Content-Type': 'text/plain' }
340354 });
341355 };
356+ const oldImportScripts = globalThis.importScripts;
357+ globalThis.importScripts = (...args) => {
358+ const newargs = args.map(url => {
359+ const urlObj = new URL(url, location.href);
360+ if (allowedOrigins.includes(urlObj.origin)) {
361+ return url;
362+ }
363+ if (proxySites && proxySites.includes(urlObj.origin)) {
364+ return proxyURL + urlObj.hostname + urlObj.pathname;
365+ }
366+ throw new Error('Script is from blocked URL');
367+ });
368+ return oldImportScripts(...newargs);
369+ };
342370 Object.defineProperty(globalThis, 'location', {
343371 value: new URL('${ scriptURL . href } '),
344372 writable: false,
0 commit comments