Allow localhost URLs when detecting write key

[nunofgs]

Useful for local testing.

This PR allows http:// URLs to be used when extracting the CDN. I considered possible security implications but quickly dismissed it because:

• This is a client-side script and can be manipulated by customers. All bets are off in that sense.
• Even if someone succeeds in using http:// for serving this file, the write key is considered public.
• For customers that are going the self-serve option and hosting the analytics.min.js file themselves, allowing http:// URLs is useful for local testing.
  • There's an argument to be made that we should encourage customers to serve their pages under https:// in this use-case by enforcing it. Ultimately because this is a client-side concern I don't think it's a problem

[nunofgs]

Escaped the - in the latter part of the regex because it wasn't a range. We intended to allow a dash -

[\w\-:]

[richdawe-cio]

This is not relevant to your PR, but I'm not really sure what the (?:min) bit at the end is doing. Non-capturing match on min seems pointless.

I wonder if it's supposed to be optionally matching .min in the path, in which case:

(analytics\.(?:min)\.js)

should probably be:

(?:analytics(\.min)?\.js)

[richdawe-cio]

Useful for local testing.

This PR allows http:// URLs to be used when extracting the CDN. I considered possible security implications but quickly dismissed it because:

Just to confirm that our CDN redirects HTTP to HTTPS:

bash-5.2$ curl -v -o /dev/null http://cdp-eu.customer.io/v1/analytics-js/snippet/REDACTED/analytics.min.js 2>&1 | grep -i -E '(HTTP/|location)'
> GET /v1/analytics-js/snippet/REDACTED/analytics.min.js HTTP/1.1
< HTTP/1.1 301 Moved Permanently
< Location: https://cdp-eu.customer.io:443/v1/analytics-js/snippet/REDACTED/analytics.min.js

bash-5.2$ curl -v -o /dev/null http://cdp.customer.io/v1/analytics-js/snippet/REDACTED/analytics.min.js 2>&1 | grep -i -E '(HTTP/|location)'
> GET /v1/analytics-js/snippet/REDACTED/analytics.min.js HTTP/1.1
< HTTP/1.1 301 Moved Permanently
< Location: https://cdp.customer.io:443/v1/analytics-js/snippet/REDACTED/analytics.min.js

[richdawe-cio]

This is not relevant to your PR, but I'm not really sure what the (?:min) bit at the end is doing. Non-capturing match on min seems pointless.

I wonder if it's supposed to be optionally matching .min in the path, in which case:

(analytics\.(?:min)\.js)

should probably be:

(?:analytics(\.min)?\.js)