Upload server.js

server.js

@@ -24,6 +24,12 @@ function normalizeUrl(u) {
   if (!u) return null
   let s = String(u).trim()
   if (!s) return null
+  
+  // Если URL уже закодирован, раскодируем его один раз перед проверкой
+  if (s.indexOf('%3A') !== -1 || s.indexOf('%3a') !== -1) {
+    try { s = decodeURIComponent(s) } catch(e) {}
+  }
+  
   if (!/^https?:\/\//i.test(s)) {
     s = 'https://' + s
   }
@@ -115,7 +121,7 @@ function jsWrapper(serverBase, baseUrl, transpiledCode, needRegenerator) {
     'function origin(u){try{var a=document.createElement("a");a.href=u;return (a.protocol? a.protocol:"") + "//" + (a.host||"");}catch(e){return "";}}' +
     'var allow=window.__es5ProxyAllow||{};window.__es5ProxyAllow=allow;' +
     'allow[origin(__es5_base)]=1;' +
-    'function proxyJs(u){var a=abs(u);var o=origin(a);if(__es5_active)allow[o]=1;allow[o]=1;if(allow[o]&&__es5_server)return __es5_server + "/p?url=" + encodeURIComponent(a);return a;}' +
+    'function proxyJs(u){var a=abs(u);var o=origin(a);if(__es5_active)allow[o]=1;allow[o]=1;if(allow[o]&&__es5_server){try{var testUrl=new URL(a);if(testUrl.protocol==="http:"||testUrl.protocol==="https:")return __es5_server + "/p?url=" + encodeURIComponent(a);}catch(e){}}return a;}' +
     'function proxyCss(u){var a=abs(u);var o=origin(a);if(__es5_active)allow[o]=1;if(allow[o]&&__es5_server)return __es5_server + "/s?url=" + encodeURIComponent(a);return a;}' +
     'function mapArr(items, fn){if(!items||!items.length)return items;for(var i=0;i<items.length;i++){items[i]=fn(items[i]);}return items;}' +
     'try{' +
@@ -130,7 +136,7 @@ function jsWrapper(serverBase, baseUrl, transpiledCode, needRegenerator) {
     'var origInsertBefore=Element.prototype.insertBefore;' +
     'function patchNode(node){' +
     'if(node&&node.tagName==="SCRIPT"&&node.src){' +
-    'var a=abs(node.src);var o2=origin(a);if(__es5_active)allow[o2]=1;allow[o2]=1;if(allow[o2]&&__es5_server&&node.src.indexOf(__es5_server)===-1){node.src=__es5_server+"/p?url="+encodeURIComponent(a);}' +
+    'var a=abs(node.src);var o2=origin(a);if(__es5_active)allow[o2]=1;allow[o2]=1;if(allow[o2]&&__es5_server&&node.src.indexOf(__es5_server)===-1){try{var testUrl=new URL(a);if(testUrl.protocol==="http:"||testUrl.protocol==="https:"){node.src=__es5_server+"/p?url="+encodeURIComponent(a);}}catch(e){}}' +
     '}' +
     '}' +
     'Element.prototype.appendChild=function(node){' +
@@ -231,7 +237,13 @@ app.get('/s', async (req, res) => {
 })
 
 app.get('/p', async (req, res) => {
-  const source = normalizeUrl(req.query.url)
+  let rawUrl = req.query.url;
+  // Попытка раскодировать URL, если он пришел дважды закодированным
+  if(rawUrl && (rawUrl.indexOf('%3A') !== -1 || rawUrl.indexOf('%3a') !== -1)){
+      try { rawUrl = decodeURIComponent(rawUrl); } catch(e){}
+  }
+  
+  const source = normalizeUrl(rawUrl)
   if (!source) return res.status(400).type('text/plain').send('Bad url')
 
   try {