Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(649)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: chrome/common/extensions/docs/manifest.html

Issue 10458063: Add sanbdoxed_pages to allow extension/app pages to be served in a sandboxed, unique origin (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Rebase Created 8 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« chrome/browser/extensions/extension_protocols.cc ('K') | « chrome/common/extensions/api/_manifest_features.json ('k') | chrome/common/extensions/docs/static/manifest.html » ('j') | chrome/common/extensions/extension.cc » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 <!DOCTYPE html><!-- This page is a placeholder for generated extensions api doc. Note: 1 <!DOCTYPE html><!-- This page is a placeholder for generated extensions api doc. Note:
2 1) The <head> information in this page is significant, should be uniform 2 1) The <head> information in this page is significant, should be uniform
3 across api docs and should be edited only with knowledge of the 3 across api docs and should be edited only with knowledge of the
4 templating mechanism. 4 templating mechanism.
5 3) All <body>.innerHTML is genereated as an rendering step. If viewed in a 5 3) All <body>.innerHTML is genereated as an rendering step. If viewed in a
6 browser, it will be re-generated from the template, json schema and 6 browser, it will be re-generated from the template, json schema and
7 authored overview content. 7 authored overview content.
8 4) The <body>.innerHTML is also generated by an offline step so that this 8 4) The <body>.innerHTML is also generated by an offline step so that this
9 page may easily be indexed by search engines. 9 page may easily be indexed by search engines.
10 --><html xmlns="http://www.w3.org/1999/xhtml"><head> 10 --><html xmlns="http://www.w3.org/1999/xhtml"><head>
(...skipping 214 matching lines...) Expand 10 before | Expand all | Expand 10 after
225 </li><li> 225 </li><li>
226 <a href="#permissions">permissions</a> 226 <a href="#permissions">permissions</a>
227 </li><li> 227 </li><li>
228 <a href="#requirements">requirements</a> 228 <a href="#requirements">requirements</a>
229 </li><li> 229 </li><li>
230 <a href="#version">version</a> 230 <a href="#version">version</a>
231 </li><li> 231 </li><li>
232 <a href="#manifest_version">manifest_version</a> 232 <a href="#manifest_version">manifest_version</a>
233 </li><li> 233 </li><li>
234 <a href="#web_accessible_resources">web_accessible_resources</ a> 234 <a href="#web_accessible_resources">web_accessible_resources</ a>
235 </li><li>
236 <a href="#sandboxed_resources">sandboxed_resources</a>
235 </li> 237 </li>
236 </ol> 238 </ol>
237 </li> 239 </li>
238 </ol> 240 </ol>
239 </div> 241 </div>
240 <!-- /TABLE OF CONTENTS --> 242 <!-- /TABLE OF CONTENTS -->
241 <!-- Standard content lead-in for experimental API pages --> 243 <!-- Standard content lead-in for experimental API pages -->
242 <!-- STATIC CONTENT PLACEHOLDER --> 244 <!-- STATIC CONTENT PLACEHOLDER -->
243 <div id="static"><div id="pageData-name" class="pageData">Formats: Manif est Files</div> 245 <div id="static"><div id="pageData-name" class="pageData">Formats: Manif est Files</div>
244 <div id="pageData-showTOC" class="pageData">true</div> 246 <div id="pageData-showTOC" class="pageData">true</div>
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after
281 "<a href="#key">key</a>": "<em>publicKey</em>", 283 "<a href="#key">key</a>": "<em>publicKey</em>",
282 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt ring</em>", 284 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt ring</em>",
283 "<a href="#nacl_modules">nacl_modules</a>": [...], 285 "<a href="#nacl_modules">nacl_modules</a>": [...],
284 "<a href="#offline_enabled">offline_enabled</a>": true, 286 "<a href="#offline_enabled">offline_enabled</a>": true,
285 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" }, 287 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" },
286 "<a href="options.html">options_page</a>": "<em>aFile</em>.html", 288 "<a href="options.html">options_page</a>": "<em>aFile</em>.html",
287 "<a href="#permissions">permissions</a>": [...], 289 "<a href="#permissions">permissions</a>": [...],
288 "<a href="npapi.html">plugins</a>": [...], 290 "<a href="npapi.html">plugins</a>": [...],
289 "<a href="#requirements">requirements</a>": {...}, 291 "<a href="#requirements">requirements</a>": {...},
290 "<a href="autoupdate.html">update_url</a>": "http://<em>path/to/updateInfo</em >.xml", 292 "<a href="autoupdate.html">update_url</a>": "http://<em>path/to/updateInfo</em >.xml",
291 "<a href="#web_accessible_resources">web_accessible_resources</a>": [...] 293 "<a href="#web_accessible_resources">web_accessible_resources</a>": [...],
294 "<a href="#sandboxed_resources">sandboxed_resources</a>": [...]
292 } 295 }
293 </pre> 296 </pre>
294 <a name="H2-1"></a><h2>Field details</h2> 297 <a name="H2-1"></a><h2>Field details</h2>
295 <p> 298 <p>
296 This section covers fields that aren't described in another page. 299 This section covers fields that aren't described in another page.
297 For a complete list of fields, 300 For a complete list of fields,
298 with links to where they're described in detail, 301 with links to where they're described in detail,
299 see the <a href="#overview">Field summary</a>. 302 see the <a href="#overview">Field summary</a>.
300 </p> 303 </p>
301 <h3 id="app">app</h3> 304 <h3 id="app">app</h3>
(...skipping 119 matching lines...) Expand 10 before | Expand all | Expand 10 after
421 </p> 424 </p>
422 <h3 id="intents">intents</h3> 425 <h3 id="intents">intents</h3>
423 <p> 426 <p>
424 A dictionary that specifies all intent handlers provided by this extension or ap p. Each key in the dictionary specifies an action verb that is handled by this e xtension. The following example specifies two handlers for the action verb "<a h ref="http://webintents.org/share">http://webintents.org/share</a>". 427 A dictionary that specifies all intent handlers provided by this extension or ap p. Each key in the dictionary specifies an action verb that is handled by this e xtension. The following example specifies two handlers for the action verb "<a h ref="http://webintents.org/share">http://webintents.org/share</a>".
425 </p> 428 </p>
426 <pre>{ 429 <pre>{
427 "name": "test", 430 "name": "test",
428 "version": "1", 431 "version": "1",
429 "intents": { 432 "intents": {
430 "http://webintents.org/share": [ 433 "http://webintents.org/share": [
431 { 434 {
432 "type": ["text/uri-list"], 435 "type": ["text/uri-list"],
433 "href": "/services/sharelink.html", 436 "href": "/services/sharelink.html",
434 "title" : "Sample Link Sharing Intent", 437 "title" : "Sample Link Sharing Intent",
435 "disposition" : "inline" 438 "disposition" : "inline"
436 }, 439 },
437 { 440 {
438 "type": ["image/*"], 441 "type": ["image/*"],
439 "href": "/services/shareimage.html", 442 "href": "/services/shareimage.html",
440 "title" : "Sample Image Sharing Intent", 443 "title" : "Sample Image Sharing Intent",
441 "disposition" : "window" 444 "disposition" : "window"
442 } 445 }
443 ] 446 ]
444 } 447 }
445 } 448 }
446 </pre> 449 </pre>
447 <p> 450 <p>
448 The value of "type" is an array of mime types that is supported by this handler. The "href" indicates the URL of the page that handles the intent. For hosted ap ps, these URLs must be within the allowed set of URLs. For extensions, all URLs are inside the extension and considered relative to the extension root URL. 451 The value of "type" is an array of mime types that is supported by this handler. The "href" indicates the URL of the page that handles the intent. For hosted ap ps, these URLs must be within the allowed set of URLs. For extensions, all URLs are inside the extension and considered relative to the extension root URL.
449 </p> 452 </p>
450 <p> 453 <p>
451 The "title" is displayed in the intent picker UI when the user initiates the act ion specific to the handler. 454 The "title" is displayed in the intent picker UI when the user initiates the act ion specific to the handler.
452 </p> 455 </p>
453 <p> 456 <p>
454 The "disposition" is either "inline" or "window". Intents with "window" disposit ion will open a new tab when invoked. Intents with "inline" disposition will be displayed inside the intent picker when invoked. 457 The "disposition" is either "inline" or "window". Intents with "window" disposit ion will open a new tab when invoked. Intents with "inline" disposition will be displayed inside the intent picker when invoked.
455 </p> 458 </p>
456 <p> 459 <p>
457 For more information on intents, refer to the <a href="http://dvcs.w3.org/hg/web -intents/raw-file/tip/spec/Overview.html">Web Intents specification</a> and <a h ref="http://www.webintents.org">webintents.org</a>. 460 For more information on intents, refer to the <a href="http://dvcs.w3.org/hg/web -intents/raw-file/tip/spec/Overview.html">Web Intents specification</a> and <a h ref="http://www.webintents.org">webintents.org</a>.
458 </p> 461 </p>
(...skipping 314 matching lines...) Expand 10 before | Expand all | Expand 10 after
773 <a href="tts.html">chrome.tts</a> module. </td> 776 <a href="tts.html">chrome.tts</a> module. </td>
774 </tr> 777 </tr>
775 <tr> 778 <tr>
776 <td> "ttsEngine" </td> 779 <td> "ttsEngine" </td>
777 <td> Required if the extension uses the 780 <td> Required if the extension uses the
778 <a href="ttsEngine.html">chrome.ttsEngine</a> module. </td> 781 <a href="ttsEngine.html">chrome.ttsEngine</a> module. </td>
779 </tr> 782 </tr>
780 <tr> 783 <tr>
781 <td> "unlimitedStorage"</td> 784 <td> "unlimitedStorage"</td>
782 <td> Provides an unlimited quota for storing HTML5 client-side data, 785 <td> Provides an unlimited quota for storing HTML5 client-side data,
783 such as databases and local storage files. 786 such as databases and local storage files.
784 Without this permission, the extension is limited to 787 Without this permission, the extension is limited to
785 5 MB of local storage. 788 5 MB of local storage.
786 <p class="note"> 789 <p class="note">
787 <b>Note:</b> 790 <b>Note:</b>
788 This permission applies only to Web SQL Database and application cache 791 This permission applies only to Web SQL Database and application cache
789 (see issue <a href="http://crbug.com/58985">58985</a>). 792 (see issue <a href="http://crbug.com/58985">58985</a>).
790 Also, it doesn't currently work with wildcard subdomains such as 793 Also, it doesn't currently work with wildcard subdomains such as
791 <code>http://*.example.com</code>. 794 <code>http://*.example.com</code>.
792 </p> 795 </p>
793 </td> 796 </td>
794 </tr><tr> 797 </tr><tr>
795 </tr><tr> 798 </tr><tr>
796 <td> "webNavigation" </td> 799 <td> "webNavigation" </td>
797 <td> Required if the extension uses the 800 <td> Required if the extension uses the
798 <a href="webNavigation.html">chrome.webNavigation</a> module. </td> 801 <a href="webNavigation.html">chrome.webNavigation</a> module. </td>
799 </tr> 802 </tr>
800 <tr> 803 <tr>
801 <td> "webRequest" </td> 804 <td> "webRequest" </td>
802 <td> Required if the extension uses the 805 <td> Required if the extension uses the
(...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after
931 <code>chrome-extension://[PACKAGE ID]/[PATH]</code>, which can be generated with 934 <code>chrome-extension://[PACKAGE ID]/[PATH]</code>, which can be generated with
932 the <a href="extension.html#method-getURL"> 935 the <a href="extension.html#method-getURL">
933 <code>chrome.extension.getURL</code> 936 <code>chrome.extension.getURL</code>
934 </a> method. Whitelisted resources are served with appropriate 937 </a> method. Whitelisted resources are served with appropriate
935 <a href="http://www.w3.org/TR/cors/">CORS</a> headers, so they're available via 938 <a href="http://www.w3.org/TR/cors/">CORS</a> headers, so they're available via
936 mechanisms like XHR. 939 mechanisms like XHR.
937 </p> 940 </p>
938 <p> 941 <p>
939 Injected content scripts themselves do not need to be whitelisted. 942 Injected content scripts themselves do not need to be whitelisted.
940 </p> 943 </p>
941 <h4>Default Availablility</h4> 944 <h4>Default Availability</h4>
942 <p> 945 <p>
943 Resources inside of packages using <a href="#manifest_version"> 946 Resources inside of packages using <a href="#manifest_version">
944 <code>manifest_version</code> 947 <code>manifest_version</code>
945 </a> 2 or above are <strong>blocked by default</strong>, and must be whitelisted 948 </a> 2 or above are <strong>blocked by default</strong>, and must be whitelisted
946 for use via this property. 949 for use via this property.
947 </p> 950 </p>
948 <p> 951 <p>
949 Resources inside of packages using <code>manifest_version</code> 1 are available 952 Resources inside of packages using <code>manifest_version</code> 1 are available
950 by default, but <em>if</em> you do set this property, then it will be treated as 953 by default, but <em>if</em> you do set this property, then it will be treated as
951 a complete list of all whitelisted resources. Resources not listed will be 954 a complete list of all whitelisted resources. Resources not listed will be
952 blocked. 955 blocked.
953 </p> 956 </p>
957 <h3 id="sandboxed_resources">sandboxed_resources</h3>
958 <p>
959 An array of strings specifying the paths (relative to the package root) of
960 packaged resources that are to be served in a sandboxed unique origin. Being
961 in a sandbox has two implications:
962 </p>
963 <ol>
964 <li>A sandboxed resource will not have access to extension or app APIs, or
965 direct access to non-sandboxed pages (they may communicate via
966 <code>postMessage()</code>).</li>
967 <li>A sandboxed resource is not subject to the
968 <a href="contentSecurityPolicy.html">Content Security Policy (CSP)</a> used
969 by the rest of the app or extension. This means that, for example, it can use
970 inline script and <code>eval</code>.</li>
971 </ol>
972 <p>
973 The sandbox is enforced by using the
974 <a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe- element.html#attr-iframe-sandbox">HTML5 sandbox</a>
975 with the tokens <code>allow-scripts allow-forms</code>.
976 </p>
977 <p>
978 Note that you only need to list resources that you expected to be loaded in
979 windows or frames. Subresources used by sandboxed pages (e.g. stylesheets or
980 JavaScript source files) do not need to appear in the
981 <code>sandboxed_resources</code> list, they will use the sandbox of the page
982 that embeds them.
983 </p>
984 <p>
985 Sandboxed resources may only be specified when using
986 <a href="#manifest_version"><code>manifest_version</code></a> 2 or above.
987 </p>
954 </div> 988 </div>
955 <!-- API PAGE --> 989 <!-- API PAGE -->
956 <!-- /apiPage --> 990 <!-- /apiPage -->
957 </div> <!-- /gc-pagecontent --> 991 </div> <!-- /gc-pagecontent -->
958 </div> <!-- /g-section --> 992 </div> <!-- /g-section -->
959 </div> <!-- /codesiteContent --> 993 </div> <!-- /codesiteContent -->
960 <div id="gc-footer" --=""> 994 <div id="gc-footer" --="">
961 <div class="text"> 995 <div class="text">
962 <p> 996 <p>
963 Except as otherwise <a href="http://code.google.com/policies.html#restrictions ">noted</a>, 997 Except as otherwise <a href="http://code.google.com/policies.html#restrictions ">noted</a>,
(...skipping 20 matching lines...) Expand all
984 _uff=0; 1018 _uff=0;
985 urchinTracker(); 1019 urchinTracker();
986 } 1020 }
987 catch(e) {/* urchinTracker not available. */} 1021 catch(e) {/* urchinTracker not available. */}
988 </script> 1022 </script>
989 <!-- end analytics --> 1023 <!-- end analytics -->
990 </div> 1024 </div>
991 </div> <!-- /gc-footer --> 1025 </div> <!-- /gc-footer -->
992 </div> <!-- /gc-container --> 1026 </div> <!-- /gc-container -->
993 </body></html> 1027 </body></html>
OLDNEW
« chrome/browser/extensions/extension_protocols.cc ('K') | « chrome/common/extensions/api/_manifest_features.json ('k') | chrome/common/extensions/docs/static/manifest.html » ('j') | chrome/common/extensions/extension.cc » ('J')

Powered by Google App Engine
This is Rietveld 408576698