codys is correct: The DHCP option provides a URL for a javascript file with a function to be called for each URL. The function then returns how to actually go

codys is correct: The DHCP option provides a URL for a javascript file with a function to be called for each URL. The function then returns how to actually go about connecting to that URL (direct or proxied connection) and what hostname to actually use, etc. This is separate from the proxy that then gets used for the actual connection if the PAC file says to use a proxy. That proxy can't inject things into pages loaded over https unless it's using an MITM cert signed with a trust root that your browser trusts. The problem under discussion is that the function in the PAC file gets to see the URL being visited.