There is no fix needed as everything is working as it should.
See HonzaZ's reply.
It is a dogs hind leg completely bent out of shape. There is no delimiting factor in the UI that explains it is only for JS and HTML. We shouldn't expect users to be mind readers to know what is the unwritten rule. Sorry but users expect if they enter a URL exclusion that it bloody works and is excluded.
It needs fixed period, one way or another:
1. full explanation of exactly what can be excluded.
2. all URLs regardless of categorisation should be allowed.
3. remove the exclusions completely.
Why the hell it can't be excluded is beyond me (even after HonzaZ's post), when the only other option is to disable the web shield completely, so they might as well have the exclusions work for all instances.