A PAC Rule for Short Names Can Bypass Your Proxy

A PAC script receives the hostname from the URL. dashboard does not automatically become dashboard.example.internal before matching:

function FindProxyForURL(url, host) {
  if (isPlainHostName(host)) {
    return "DIRECT";
  }
  return "PROXY 203.0.113.10:8080";
}

Use a real HTTP endpoint in place of the documentation address; the HTTP proxy list provides candidates for public-destination tests where that route is allowed. In this script, the short name deliberately returns DIRECT; the fully qualified name reaches the proxy branch. “Plain hostname” means a no-dot spelling, not a finding that the host is on a trusted local network.

If the desired policy is one internal domain, match that domain rather than every short name. dnsDomainIs and shExpMatch have different inputs and pattern semantics. A suffix check for .example.internal does not include the exact root example.internal; include that case explicitly when intended. A shell-style pattern is not an IP subnet or regular expression.

Compare the script's result for the short name, fully qualified name, an unrelated public host and any intended domain root. This tests rule selection without connecting to the proxy. Inspect the first returning rule when a broad DIRECT branch prevents an otherwise reachable endpoint from being tried.

Use a name comparison when it expresses the policy; DNS helpers add their own lookups and delay. Keep browser implicit local bypass separate from the script too. A localhost check cannot substitute for the real public or internal destination spelling.