Test case:
https://www.raymondhill.net/httpsb/httpsb-test-js-1.html

• Enable javascript for both www.raymondhill.net and www.xenu-directory.net

Javascript works, as expected.

• Disable javascript for www.xenu-directory.net

Javascript is blocked for the static reference to external file on blacklisted host, but (curiously) runs for dynamic reference to blacklisted host.

No explicit web request was fired by chromium for the dynamically constructed javascript tag. This must be the reason:

https://developer.chrome.com/extensions/webRequest.html#caching

Although I have no idea why the static reference would not also sit in the in-memory cache..

Conditions for this bug to happen:

• The script had to be allowed first (allow www.xenu-directory.net, than block www.xenu-directory.net)
• Javascript must not be blocked for the page (www.raymondhill.net here)

Thus it won't happen if the script was never loaded, however I still consider this a serious bug: in that specific instance, HTTPSB doesn't do what it says it is doing.

Chrome doc says to call handlerBehaviorChanged(), but at the same time they say it "shouldn't be called often"... So I will have to find a solution which doesn't rely on handlerBehaviorChanged(), as there is no way I can control what the user does.

I will have to consider beforeload event.