What
When the sandbox blocks an outbound connection, it records a violation naming the host, the port and a reason instead of silently failing. Reasons include sandbox policy unavailable, malformed host, host is on the deny list, host is not on the allow list, user denied, and permission prompt failed.
Details
- Blocked HTTP requests get their own violation line with the URL query string redacted.
- A per-domain reason override can be supplied through
deniedDomainReasons. - Domain rules can now carry a
:portsuffix, matched against the port of the connection.
Evidence
host is not on the allow list
Strings lifted out of the shipped bundle, so the claim above can be checked against them.