Feeling smug

Author: A5rocks

package-lock.json

@@ -0,0 +1,21 @@
+{
+  "name": "pyrox",
+  "version": "1.0.0",
+  "description": "Proxy that runs on [Cloudflare Workers](https://workers.dev).",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/bots-gg/pyrox.git"
+  },
+  "author": "A5rocks",
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/bots-gg/pyrox/issues"
+  },
+  "homepage": "https://github.com/bots-gg/pyrox#readme",
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20230511.0"
+  },
+  "dependencies": {
+    "@bots-gg/markup": "^1.3.1"
+  }
+}

package.json

@@ -1,3 +1,5 @@
+import { escapeCSS } from "@bots-gg/markup";
+
 const parseHex = (hex: string) => {
   const buf = new ArrayBuffer(hex.length / 2);
   const bufView = new Uint8Array(buf);
@@ -24,6 +26,11 @@ const parseB64 = (b64: string) => {
   return buf;
 }
 
+const getMimeType = (contentType: string | undefined) =>
+  contentType?.includes(";")
+  ? contentType.split(";")[0].trim()
+  : contentType?.trim();
+
 export default {
   async fetch(request: Request, { PUBLIC_KEY }: { PUBLIC_KEY: string }): Promise<Response> {
     const userAgent = request.headers.get('User-Agent');
@@ -68,8 +75,42 @@ export default {
     const requestedUrl = new URL(subUrl, url.origin);
 
     const resp = await fetch(requestedUrl.toString(), { headers: new Headers({ 'User-Agent': userAgent }) });
-    const newResp = new Response(resp.body, resp);  // ??
-    newResp.headers.set("Content-Security-Policy", "default-src: 'self';")
+
+    let body: Response['body'] | string = resp.body;
+    console.log({"content-type": resp.headers.get("Content-Type")?.toLowerCase()});
+    if (getMimeType(resp.headers.get("Content-Type")?.toLowerCase()) === "text/css") {
+      // this sucks...
+      const text = await resp.text();
+      const urls: string[] = [];
+      escapeCSS(text, (url: string) => {
+        urls.push(url);
+        return url;
+      });
+
+      let giveUp = false;
+      const responses = await Promise.all(urls.map(async (url) => {
+        const otherResp = await fetch((new URL(url, request.url)));
+        const mimeType = getMimeType(otherResp.headers.get("Content-Type")?.toLowerCase());
+        if (mimeType === "text/css") {
+          giveUp = true;
+        }
+        // *smug smirk*
+        return `data:${mimeType};base64,${btoa(await otherResp.text())}`;
+      }));
+
+      if (giveUp) {
+        return new Response("You suck.");
+      }
+
+      const urlMap = Object.fromEntries(urls.map((url, i) => [url, i]));
+
+      body = escapeCSS(text, (url: string) => responses[urlMap[url]]);
+    }
+
+    const newResp = new Response(body, resp);  // :(
+    newResp.headers.set("Content-Security-Policy", "default-src: 'self';");
+    newResp.headers.set("X-Content-Type-Options", "nosniff");
+
     return newResp;
   }
 };