fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115)

This commit is contained in:
jackfromeast 2024-09-16 11:42:53 -04:00 committed by patak
parent 4573a6fd6f
commit 2691bb3ff6

View File

@ -1133,7 +1133,7 @@ const getRelativeUrlFromDocument = (relativePath: string, umd = false) =>
getResolveUrl(
`'${escapeId(partialEncodeURIPath(relativePath))}', ${
umd ? `typeof document === 'undefined' ? location.href : ` : ''
}document.currentScript && document.currentScript.src || document.baseURI`,
}document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`,
)
const getFileUrlFromFullPath = (path: string) =>