{"version":"2.1.268","anchor":"domain-pattern-validation-rejects-overly-broad-wildcards-for","canonical_anchor":"domain-pattern-validation-rejects-overly-broad-wildcards-for","heading":"Domain-pattern validation rejects overly-broad wildcards for allowedDomains\/deniedDomains","tier":"notice","area":"Sandbox Network","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/domain-pattern-validation-rejects-overly-broad-wildcards-for","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### Domain-pattern validation rejects overly-broad wildcards for allowedDomains\/deniedDomains\n\nSandbox domain lists now reject overly broad wildcard patterns like *.com\n\n**What**\n\nEntries in `allowedDomains` and `deniedDomains` (the sandbox's network allow\/deny lists) must now be a real domain name, a single-level wildcard like `*.example.com`, `localhost`, or a bracketed IPv6 address. Overly broad patterns such as a bare `*` or `*.com` are rejected for `allowedDomains`; `deniedDomains` still allows a bare `*` since that means \"deny everything\".\n\n**Why**\n\nThis prevents an accidentally or intentionally overbroad allow rule from opening network access far wider than intended, closing off a class of overly permissive sandbox configurations.\n\n- Area: Sandbox Network\n- Names: `allowedDomains`, `deniedDomains`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}