From e8127166979e7ace6eeaa2c3b733c8994caa31f3 Mon Sep 17 00:00:00 2001 From: jackfromeast Date: Mon, 16 Sep 2024 11:42:53 -0400 Subject: [PATCH] fix: avoid DOM Clobbering gadget in `getRelativeUrlFromDocument` (#18115) --- packages/vite/src/node/build.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/vite/src/node/build.ts b/packages/vite/src/node/build.ts index ec9173e18afed4..64432fc53e99c2 100644 --- a/packages/vite/src/node/build.ts +++ b/packages/vite/src/node/build.ts @@ -1100,7 +1100,7 @@ const getRelativeUrlFromDocument = (relativePath: string, umd = false) => getResolveUrl( `'${escapeId(relativePath)}', ${ umd ? `typeof document === 'undefined' ? location.href : ` : '' - }document.currentScript && document.currentScript.src || document.baseURI`, + }document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`, ) const getFileUrlFromFullPath = (path: string) =>