What
Domain allow and deny rules in the sandbox now parse a host pattern plus an optional port, so a rule can target a single port rather than the whole host.
Details
- Matching fails closed on both sides: a port-qualified rule matches a request with an unknown port when denying, and does not match when allowing.
- Otherwise the port must match exactly.
- Deny rules still come from
sandbox.network.deniedDomainsplus WebFetch-styledomain:permission rules.
Evidence
sandbox.network.allowManagedDomainsOnly is set and
Strings lifted out of the shipped bundle, so the claim above can be checked against them.