fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115

)
vitejs · Sep 16, 2024 · ade1d89 · ade1d89
1 parent 9d2413c
commit ade1d89
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/vite/src/node/build.ts b/packages/vite/src/node/build.ts
@@ -1297,7 +1297,7 @@ const getRelativeUrlFromDocument = (relativePath: string, umd = false) =>
   getResolveUrl(
     `'${escapeId(partialEncodeURIPath(relativePath))}', ${
       umd ? `typeof document === 'undefined' ? location.href : ` : ''
-    }document.currentScript && document.currentScript.src || document.baseURI`,
+    }document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`,
   )
 
 const getFileUrlFromFullPath = (path: string) =>