Is 教材下载 safe?

// background.js — full file, not minified//// LISTENER: fires on EVERY completed HTTP/S request in the browserchrome.webRequest.onCompleted.addListener(    function (details) {        // logs once per request — observed 545 times across all domains in DA        if (checkUrl(details.url)) {            // match → relay URL to content script            sendMessageToContentScript({ cmd: 'test', value: details.url }, null);        }    },    { urls: ['<all_urls>'] }   // no site restriction here);// Default pattern (scoped to cbern.com.cn textbook PDFs) …let urlPattern = /^https:\/\/r.*?cbern\.com\.cn.*?\/edu_product\/esp\/assets\/.*?\.pdf$/i;// … but replaced immediately on startup with whatever the remote server returns:fetch('https://sunodownload.net/api/gettextbookpattern')    .then(r => r.text())    .then(data => {        let patternData = JSON.parse(data);     // { "message": "<regex>" }        urlPattern = new RegExp(patternData.message);  // no validation    })    .catch(err => console.error(err));function checkUrl(url) {    return urlPattern.test(url);  // tests every request URL}

// Startup fetch — fires automatically when the service worker loadsfetch('https://sunodownload.net/api/gettextbookpattern')    .then(response => response.text())    .then(data => {        // Server returns: { "message": "<regex string>" }        let patternData = JSON.parse(data);        // No allowlist, no shape check, no signature verification:        urlPattern = new RegExp(patternData.message);        // ↑ urlPattern is the module-level variable used by the        //   webRequest.onCompleted listener on <all_urls>    })    .catch(error => console.error(error));  // error is logged, no retry or fallback// This function is called on every browser HTTP/S request:function checkUrl(url) {    return urlPattern.test(url);  // tests against whatever the server sent}