content-security-policy/sandbox/sandbox-empty.sub.html: headers file is misnamed, so the CSP sandbox is never applied #63812

content-security-policy/sandbox/sandbox-empty.sub.html loads support/sandboxed-post-message-to-parent.html in an iframe. It expects the frame to be sandboxed by a Content-Security-Policy: sandbox response header, so the frame's script must not run, and only PASS2 is logged by the iframe's onload.

The header lives in support/sandboxed-post-message-to-parent.headers. wptserve only applies <path>.headers / <path>.sub.headers for the exact resource path (tools/wptserve/wptserve/handlers.py, load_headers), plus __dir__.headers. So the file that would apply is sandboxed-post-message-to-parent.html.headers. As named, the header is never sent, the frame is not sandboxed, and its script runs window.top.postMessage("Message", "*").

The test still passes everywhere (wpt.fyi, aligned stable run at cc74d26: Chrome, Firefox and Safari all 1/1). That is only because the iframe's load event, which logs PASS2 and completes the logTest, is handled before the posted message. If the message arrives first, logTest.sub.js fails with "unexpected log: Message". In other words, the test currently checks event ordering, not CSP sandboxing.

Suggested fix: rename content-security-policy/sandbox/support/sandboxed-post-message-to-parent.headers to sandboxed-post-message-to-parent.html.headers. The sibling files in that directory, such as sandboxed-eval.sub.html.sub.headers, already follow that pattern. With the header applied, the frame's script is blocked by the sandbox, and the test checks what it means to.