If someone uploaded the JavaScript attack payload to your server already before this change the rewrite just changes where the file is retrieved from but the vulnerability remains as it's still coming from the same domain when the browser fetches it