fetch('https://meta.miraheze.org/wiki/Miraheze?action=raw') is blocked as expected, but appending &ARBITRARY=.gif makes it pass, for example:
fetch('https://meta.miraheze.org/wiki/Miraheze?action=raw&ARBITRARY=.gif') .then((res) => res.text()) .then((res) => console.log(res))
succeed but shouldn't.
The related vcl code is: https://github.com/miraheze/puppet/blob/d79f1773/modules/varnish/templates/default.vcl#L406-L414