FindProxyForURL Receives the Destination, Not the PAC Download URL
A query parameter used to fetch a PAC file is not automatically exposed as part of each destination URL passed to the routing function.
Suppose your configuration URL is https://config.example/proxy.pac?office=west. Inside FindProxyForURL(url, host), the url argument is not that configuration URL.
It describes the destination request being routed, subject to the client's documented sanitization. The script does not gain a page-like location.search containing the PAC download's query string.
If the query parameter selects a configuration, let the configuration server use it deliberately when generating the returned script. The client then receives an explicit policy rather than attempting to recover unavailable download metadata during every routing decision.
Keep the input controlled and avoid publishing secrets in the configuration URL. A URL used for distribution can appear in configuration records and server logs.
This is separate from parsing a destination's query. Browsers can remove HTTPS path and query information from that destination input too, but that is another boundary, not access to the PAC download URL.