The network.deniedDomains setting now accepts the bare string "*" as a special deny-all value, blocking all outbound connections that are not covered by allowedDomains.
Details
- Previously,
deniedDomainsonly accepted domain patterns. Now["*"]means deny everything. - Unlike
allowedDomains, which does not accept a bare"*", the deny list specifically supports this to make it easy to implement an allowlist-only policy.
Evidence
Schema updated to z.union([z.literal(""), domainPattern]) (search for "Unlike allowedDomains, a bare \"\" is accepted here (deny-all).")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.