FindProxyForURL Beta

PAC-E018 · browser-or-node-objects-in-pac

Browser or Node.js objects used in the PAC

high · Errors and robustness

A PAC file runs neither in a web page nor in Node.js. window, document, navigator, fetch, setTimeout, process, require and similar objects are not defined, so using them throws an error and the browser treats the file as broken.

Why it matters

PAC code runs in a small JavaScript context that has the ECMAScript built-ins (String, Array, Math and so on) and the PAC helper functions, nothing else. Objects from a web page, such as window, document, navigator, localStorage, XMLHttpRequest, fetch, setTimeout and setInterval, do not exist there. The same holds for the Node.js objects process, require, module, exports, global and Buffer: a file that reads environment variables through process or calls require() fails before it returns anything.

Using one of these names throws a ReferenceError (“x is not defined”), which has the same effect as any other exception (PAC-E006): the request is handled as a script failure. In the lab, Chrome 145 and pactester 1.4.6 and 1.5.3 had no window, setTimeout or fetch, and Windows (WinHTTP, Windows 11) had no window or navigator.

console is a special case: some engines define it and some do not. PAC-K022 covers it.

How to fix

Remove window, document, navigator, fetch, setTimeout, process and require references. Decide on url and host only, and test the file with a separate test tool.

Examples

Bad

function FindProxyForURL(url, host) {
  if (navigator.userAgent.indexOf("Firefox") >= 0) {
    return "DIRECT";
  }
  return "PROXY proxy.corp.example:8080";
}
Open bad example in checker

Good

function FindProxyForURL(url, host) {
  return "PROXY proxy.corp.example:8080";
}
Open good example in checker

Engine behaviour

EngineBehaviourSource
chromiumwindow, setTimeout and fetch are undefined in the PAC context; using them throws.lab, verified 2026-10-04
pacparserwindow, setTimeout and fetch are undefined in 1.4.6 and 1.5.3; using them throws.lab, verified 2026-10-04
winhttpwindow and navigator are undefined; using them throws.lab, verified 2026-10-11

Source: code = read in the engine's source, doc = vendor documentation, lab = observed in a lab run, expert = practitioner knowledge, not yet verified.

Related rules

References