PAC File Not Functioning After Modification

Question

I have this weird behavior from a PAC File. I have an existing PAC File that is working fine. Due to recent migrations, I had to start modifying the PAC file, and exclude some IPs and URLs, mainly for MS Teams, from the proxy.

After testing the modification, I found that there is extreme latency in the browsing. Working on the PAC File, I tuned it to decrease the network requests and to resolve the domains one time, then check the IP Address. However, it caused every website that has to go to the proxy not working.

Below is my updated PAC File Removing some details from it:

function FindProxyForURL(url, host) {

    if(!isResolvable(host))
        return "DIRECT";
    var resolved_IP = dnsResolve(host);
    
    if ((shExpMatch(url, "ctldl.windowsupdate.com")) || 
    (shExpMatch(url, "download.windowsupdate.com")) || 
    (shExpMatch(url, "windowsupdate.microsoft.com")) || 
    (shExpMatch(url, "update.microsoft.com")) || 
    //check for local IP addresses
    (isInNet(resolved_IP, "127.0.0.1", "255.0.0.0")) || 
    (shExpMatch(url, "*.internaldomain1.com")) || 
    (shExpMatch(url, "*.internaldomain2.com")) || 
    (shExpMatch(url, "*.internaldomain3.com")) || 
    (shExpMatch(url, "internaldomain4.com")) ||
    /* Skype for Business and MS Teams */
    (isInNet(resolved_IP, "52.112.0.0", "255.252.0.0")) || 
    (isInNet(resolved_IP, "52.120.0.0", "255.252.0.0")))
        return "DIRECT"; 
    else
        if (url.substring(0, 5) == 'http:' ||
        url.substring(0, 6) == 'https:' ||
        url.substring(0, 4) == 'ftp:')
        return "PROXY <Primary Proxy IP>:8080; PROXY <Secondary Proxy IP>:8080";
    return 'DIRECT';
}

I'm not sure what I'm missing here causing the denial of requests.

I also enabled Developers Tools on Firefox, and saw blocked requests (not every time though)

=============================

UPDATE:

PAC File Before Modification

function FindProxyForURL(url, host) {

    if (shExpMatch(url, "ctldl.windowsupdate.com")) { return "DIRECT"; }
    if (shExpMatch(url, "download.windowsupdate.com")) { return "DIRECT"; }
    if (shExpMatch(url, "windowsupdate.microsoft.com")) { return "DIRECT"; }
    if (shExpMatch(url, "update.microsoft.com")) { return "DIRECT"; }


     //check for local IP addresses
    if ((shExpMatch(host, "127.0.0.1"))

                 || (shExpMatch(host, "*.domain1.com"))
                 || (shExpMatch(host, "*.domain2.com"))
                 || (shExpMatch(host, "*.domain3.com"))
                 || (shExpMatch(host, "domain3.com"))


         ) { return "DIRECT"; }


if (url.substring(0, 5) == 'http:' ||
url.substring(0, 6) == 'https:' ||
url.substring(0, 4) == 'ftp:')
{
return "PROXY <Proxy1>:8080; PROXY <Proxy2>:8080";
}
return 'DIRECT';
}

Answer 1

First of all this is illegal - shExpMatch(url, "*.internaldomain1.com" because its not always a regexp. This is legal:

shExpMatch(url, "*.internaldomain1.com/*")

or

shExpMatch(host, "*.internaldomain1.com")

You had hosts matching but new PAC has url matching. Not sure it has something with proxy sites problem. For this we have to know what refusing means - what error you get accessing what site.