← All tests

Shields scope on a CSP-sandboxed page

A response served with Content-Security-Policy: sandbox allow-scripts gets an opaque origin, so Shields has no site to scope a per-site exception to. The reported bug: it writes the toggle into the global defaults instead, so turning Block scripts off on one sandboxed page turns scripts on everywhere.

Open the sandboxed page (control: same page, no CSP header).

Script state on this origin

Shields was never touched for this origin, so this reading follows the global Block Scripts default.

Scripts BLOCKED here.

Steps

  1. brave://settings/shields: turn the global Block Scripts default on.
  2. Reload this page. It should read BLOCKED; if not, clear any leftover site exception first.
  3. On the sandboxed page, turn Block scripts off in its Shields panel.
  4. Reload this page.

Fixed: still BLOCKED, global default untouched.

Bug: now ALLOWED, and brave://settings/shields shows Block Scripts off.

The sandboxed page lacks allow-top-navigation, so its links do nothing; use the back button. Restore the global default when done.