fix closure bug for trusted-replace-xhr-response

Author: stanislav-atr

src/scriptlets/trusted-replace-xhr-response.js

@@ -90,9 +90,7 @@ export function trustedReplaceXhrResponse(source, pattern = '', replacement = ''
     const nativeOpen = window.XMLHttpRequest.prototype.open;
     const nativeSend = window.XMLHttpRequest.prototype.send;
 
-    let shouldReplace = false;
     let xhrData;
-    let requestHeaders = [];
 
     const openWrapper = (target, thisArg, args) => {
         // eslint-disable-next-line prefer-spread
@@ -106,13 +104,16 @@ export function trustedReplaceXhrResponse(source, pattern = '', replacement = ''
             return Reflect.apply(target, thisArg, args);
         }
 
-        shouldReplace = matchRequestProps(source, propsToMatch, xhrData);
+        if (matchRequestProps(source, propsToMatch, xhrData)) {
+            thisArg.shouldBePrevented = true;
+        }
 
         // Trap setRequestHeader of target xhr object to mimic request headers later
-        if (shouldReplace) {
+        if (thisArg.shouldBePrevented) {
+            thisArg.collectedHeaders = [];
             const setRequestHeaderWrapper = (target, thisArg, args) => {
                 // Collect headers
-                requestHeaders.push(args);
+                thisArg.collectedHeaders.push(args);
                 return Reflect.apply(target, thisArg, args);
             };
 
@@ -129,7 +130,7 @@ export function trustedReplaceXhrResponse(source, pattern = '', replacement = ''
     };
 
     const sendWrapper = (target, thisArg, args) => {
-        if (!shouldReplace) {
+        if (!thisArg.shouldBePrevented) {
             return Reflect.apply(target, thisArg, args);
         }
 
@@ -197,13 +198,13 @@ export function trustedReplaceXhrResponse(source, pattern = '', replacement = ''
 
         // Mimic request headers before sending
         // setRequestHeader can only be called on open request objects
-        requestHeaders.forEach((header) => {
+        thisArg.collectedHeaders.forEach((header) => {
             const name = header[0];
             const value = header[1];
 
             forgedRequest.setRequestHeader(name, value);
         });
-        requestHeaders = [];
+        thisArg.collectedHeaders = [];
 
         try {
             nativeSend.call(forgedRequest, args);

tests/scriptlets/prevent-xhr.test.js

@@ -608,7 +608,6 @@ if (isSupported) {
         xhr2.open(METHOD, URL_TO_BLOCK);
 
         xhr1.onload = () => {
-            clearGlobalProps('hit');
             assert.strictEqual(xhr1.readyState, 4, 'Response done');
             assert.ok(xhr1.response, 'Response data exists');
             assert.strictEqual(window.hit, undefined, 'hit should not fire');