New tab (ntp.msn.com) in Edge is broken

[AdamWr]

Steps to reproduce:

1. Open Edge

Actual behavior

New tab is broken.
It happens even if I disable all modules (Ad Blocker, Stealth Mode, Browsing Security, DNS Protection, Extensions), but works fine with AdGuard protection disabled.

Screenshot

Expected behavior

New tab should be displayed correctly.

Screenshot

AdGuard for Windows 7.7 nightly 28 (build 3730, CL 1.8.227)

[AdamWr]

I can't reproduce this issue anymore.

[knxrb]

I have this exact issue currently as well using:

Windows 10
MS Edge 95.0.1020.40 (Official build) (64-bit)
Adguard 7.7.1 (build 3729, CL 1.8.227)

[ameshkov]

@AdamWr @sfionov here's how to reproduce this:

1. Open new tab
2. Open developer tools
3. Go to "Application" tab
4. Click "Clear site data" there
5. Refresh the tab

[ameshkov]

You may need to do that a few times, the issue is reproduced randomly

[ameshkov]

Problematic CSP:

content-security-policy: child-src 'self'; connect-src 'self' *.mavideo.microsoft.com arc.msn.com assets.msn.com assets.msn.cn browser.events.data.msn.com browser.events.data.msn.cn business.bing.com/api/ usgov.business.bing.com/api/ cdn.hubblecontent.osi.office.net events-sandbox.data.msn.com events-sandbox.data.msn.cn finance-services.msn.com https://*.sharepoint.com/_api/v2.0/ https://*.sharepoint-df.com/_api/v2.0/ https://*.sharepoint.com/_api/v2.1/ https://*.sharepoint-df.com/_api/v2.1/ https://bingretailmsndata.azureedge.net/msndata/ https://browser.pipe.aria.microsoft.com/Collector/ https://jsconfig.adsafeprotected.com https://g.bing.com https://petrol.office.microsoft.com/v1/feedback https://privacyportal.onetrust.com/request/v1/consentreceipts https://sapphire.api.microsoftapp.net https://services.bingapis.com https://substrate.office.com/PeoplePredictionsB2/StreamsPreview https://substrate.office.com/PeoplePredictionsB2/StreamsPreviewById https://substrate.office.com/autodiscover/ https://trafficanswer.trafficmanager.net https://www.clarity.ms img-s-msn-com.akamaized.net login.microsoftonline.com/common/ notification.services.msn.com ocws.officeapps.live.com/ocs/ odc.officeapps.live.com/odc/ prod-video-cms-amp-microsoft-com.akamaized.net r.bing.com/rp/rms_pr.png raka.bing.com/rp/rms_pr.png ris.api.iris.microsoft.com srtb.msn.com substrate.office.com/FocusedInboxB2/api/v1/ substrate.office.com/PeoplePredictionsB2/MeTaPreview substrate.office.com/PeoplePredictionsB2/SPImageProxied substrate.office.com/PeoplePredictionsB2/SpPreview substrate.office.com/api/beta/me/WorkingSetFiles substrate.office.com/api/beta/me/officegraphinsights/trending substrate.office.com/api/v2.0/ substrate.office.com/peoplepredictionsb2/feedback substrate.office.com/peoplepredictionsb2/microsoftfeed substrate.office.com/recommended/api/v1.0/files substrate.office.com/search/api/v1/ substrate.office.com/todo/api/v1/ substrate.office.com/todob2/api/v1/ webshell.suite.office.com/api/shell/newtab wss://www.bing.com/opaluqu/speech/recognition/interactive/cognitiveservices/ www.msn.com cn.bing.com/api/v6/Places/AutoSuggest cn.bing.com/api/v6/geoentities cn.bing.com/bnc/ cn.bing.com/pnp/ cn.bing.com/profile/interestmanager/update www.bing.com/HPImageArchive.aspx www.bing.com/api/custom/opal/reco/ www.bing.com/api/v1/mediation/trends www.bing.com/api/v6/Places/AutoSuggest www.bing.com/api/v6/geoentities www.bing.com/as/ www.bing.com/AS/Suggestions www.bing.com/bnc/ www.bing.com/crop/warmer.png www.bing.com/historyHandler www.bing.com/images/sbidlg www.bing.com/pnp/ www.bing.com/profile/history/data www.bing.com/profile/interestmanager/update www.bing.com/retail/msn/api/shopcard www.bing.com/retailexp/msn/api/ www.bing.com/retailexpdata/msndata/ www.bing.com/rp/rms_pr.png www.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net *.oneservice.msn.com api.msn.com ent-api.msn.com ppe-api.msn.com graph.microsoft.com/beta/ graph.microsoft.com/v1.0/ local.adguard.org ws://local.adguard.org wss://local.adguard.org; default-src local.adguard.org; font-src 'self' data: assets.msn.com assets.msn.cn; frame-src https://api.msn.com/auth/cookie/silentpassport https://www.msn.com login.live.com/login.srf login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv 'self' data:; img-src https://* blob: data: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ local.adguard.org; media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net; script-src 'nonce-C82CG/cHWVknsGFY/myJ+q/t7NoZ0uICwSfTXAjHtPE=' 'strict-dynamic',script-src 'nonce-C82CG/cHWVknsGFY/myJ+q/t7NoZ0uICwSfTXAjHtPE=' 'self' assets.msn.cn assets.msn.com c.s-microsoft.com/mscc/ connect.facebook.net geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com local.adguard.org 'unsafe-eval' 'nonce-ef984d1ef7b5463982a3a812368'; style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets.msn.cn local.adguard.org; worker-src 'self' blob:

[ameshkov]

Btw, use the very same instruction to fix that.

[sfionov]

@ameshkov
I have another script-src, and problem doesn't reproduce:
script-src 'self' assets.msn.cn assets.msn.com c.s-microsoft.com/mscc/ connect.facebook.net geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com 'nonce-lslaIVjiv9T3gTTG4yimreTK/Ajoe48iwyIArO5IFr0=' local.adguard.org 'unsafe-eval' 'nonce-57ef0abca1a14af7a66eb95bdbd';

This differs from yours script-src:
script-src 'nonce-C82CG/cHWVknsGFY/myJ+q/t7NoZ0uICwSfTXAjHtPE=' 'strict-dynamic',script-src 'nonce-C82CG/cHWVknsGFY/myJ+q/t7NoZ0uICwSfTXAjHtPE=' 'self' assets.msn.cn assets.msn.com c.s-microsoft.com/mscc/ connect.facebook.net geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com local.adguard.org 'unsafe-eval' 'nonce-ef984d1ef7b5463982a3a812368';

[ameshkov]

The fix has been shipped in the latest nightly version of AG.