It appears to be well documented, that this can be used to perform MITM-attacks on HTTP traffic. However I don't see any discussion on the impact on HTTPS traffic.
As far as I can tell, it does not permit for a full MITM-attack on the HTTPS traffic since the PAC script can only direct the browser to which proxy to use, but there will still be an end-to-end SSL connection between the client and the legitimate server.
However one of the arguments for the
FindProxyForURL function provided by the attacker is the full URL. Moreover
FindProxyForURL can trigger DNS lookups.
Can an attacker utilize this to leak HTTPS URLs? If not, what protection is in place to prevent such leaks?