fix #2218: don't blacklist the installed scripts

src/background/utils/url.js

@@ -9,8 +9,8 @@ export const requestLimited = limitConcurrency(request, 4, 100, 1000,
 );
 
 addOwnCommands({
-  async Request({ url, ...opts }) {
-    const vettedUrl = vetUrl(url);
+  async Request({ url, vet, ...opts }) {
+    const vettedUrl = vet ? vetUrl(url) : url;
     const fn = isRemote(vettedUrl) && !isCdnUrlRe.test(vettedUrl)
       ? requestLimited
       : request;

src/confirm/views/app.vue

@@ -386,13 +386,15 @@ async function loadDeps() {
 function closeTab() {
   sendCmdDirectly('TabClose');
 }
-async function getFile(url, { isBlob, useCache } = {}) {
+async function getFile(url, opts) {
+  const { isBlob, useCache } = opts || {};
   const cacheKey = isBlob ? `blob+${url}` : `text+${url}`;
   if (useCache && cache.has(cacheKey)) {
     return cache.get(cacheKey);
   }
   const { data } = await sendCmdDirectly('Request', {
     url,
+    vet: !!opts, // TODO: add a blacklist for installation URLs?
     [kResponseType]: isBlob ? 'blob' : null,
   });
   if (useCache) cache.put(cacheKey, data);