[vulnerability] HTML/SVG responses with irregular extensions are not hooked

[t2ym]

[vulnerability] HTML/SVG responses with irregular extensions are not hooked

Root Causes

• Only extensions are checked for HTML/SVG detection
• Content-Type headers are ignored

Fix

diff --git a/lib/service-worker.js b/lib/service-worker.js
index 21074c79..899609bb 100644
--- a/lib/service-worker.js
+++ b/lib/service-worker.js
@@ -288,8 +288,8 @@ module.exports = function (hook, preprocess) {
                     }
                   });
                 }
-                else if (url.pathname.match(/(\/|[.]html?|[.]svg)$/)) {
-                  let isSVG = url.pathname.match(/([.]svg)$/);
+                else if (url.pathname.match(/(\/|[.]html?|[.]svg)$/) || response.headers.get('content-type').match(/^text\/html|image\/svg\+xml/)) {
+                  let isSVG = url.pathname.match(/([.]svg)$/) || response.headers.get('content-type').match(/^image\/svg\+xml/);
                   let original;
                   let decoded;
                   let contextGeneratorScripts = [];