Add sanbdoxed_pages to allow extension/app pages to be served in a sandboxed, unique origin

chrome/common/extensions/docs/static/manifest.html

 <div id="pageData-name" class="pageData">Formats: Manifest Files</div>
 <div id="pageData-showTOC" class="pageData">true</div>
 
 <p>
 Every extension, installable web app, and theme has a
 <a href="http://www.json.org">JSON</a>-formatted manifest file,
 named <code>manifest.json</code>,
 that provides important information.
 </p>
 
@@ skipping 37 matching lines @@
   "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionString</em>",
 
   "<a href="#nacl_modules">nacl_modules</a>": [...],
   "<a href="#offline_enabled">offline_enabled</a>": true,
   "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" },
   "<a href="options.html">options_page</a>": "<em>aFile</em>.html",
   "<a href="#permissions">permissions</a>": [...],
   "<a href="npapi.html">plugins</a>": [...],
   "<a href="#requirements">requirements</a>": {...},
   "<a href="autoupdate.html">update_url</a>": "http://<em>path/to/updateInfo</em>.xml",
-  "<a href="#web_accessible_resources">web_accessible_resources</a>": [...]
+  "<a href="#web_accessible_resources">web_accessible_resources</a>": [...],
+  "<a href="#sandboxed_resources">sandboxed_resources</a>": [...]
 }
 </pre>
 
 
 <h2>Field details</h2>
 
 <p>
 This section covers fields that aren't described in another page.
 For a complete list of fields,
 with links to where they're described in detail,
@@ skipping 148 matching lines @@
 <p>
 A dictionary that specifies all intent handlers provided by this extension or app. Each key in the dictionary specifies an action verb that is handled by this extension. The following example specifies two handlers for the action verb "<a href="http://webintents.org/share">http://webintents.org/share</a>".
 </p>
 
 <pre>
 {
   "name": "test",
   "version": "1",
   "intents": {
     "http://webintents.org/share": [
-      { 
+      {
         "type": ["text/uri-list"],
         "href": "/services/sharelink.html",
         "title" : "Sample Link Sharing Intent",
         "disposition" : "inline"
       },
       {
         "type": ["image/*"],
         "href": "/services/shareimage.html",
         "title" : "Sample Image Sharing Intent",
         "disposition" : "window"
       }
     ]
-  }  
+  }
 }
 </pre>
 
 <p>
-The value of "type" is an array of mime types that is supported by this handler. The "href" indicates the URL of the page that handles the intent. For hosted apps, these URLs must be within the allowed set of URLs. For extensions, all URLs are inside the extension and considered relative to the extension root URL. 
+The value of "type" is an array of mime types that is supported by this handler. The "href" indicates the URL of the page that handles the intent. For hosted apps, these URLs must be within the allowed set of URLs. For extensions, all URLs are inside the extension and considered relative to the extension root URL.
 </p>
 
 <p>
 The "title" is displayed in the intent picker UI when the user initiates the action specific to the handler.
 </p>
 
 <p>
 The "disposition" is either "inline" or "window". Intents with "window" disposition will open a new tab when invoked. Intents with "inline" disposition will be displayed inside the intent picker when invoked.
 </p>
 
@@ skipping 352 matching lines @@
        <a href="tts.html">chrome.tts</a> module. </td>
 </tr>
 <tr>
   <td> "ttsEngine" </td>
   <td> Required if the extension uses the
        <a href="ttsEngine.html">chrome.ttsEngine</a> module. </td>
 </tr>
 <tr>
   <td> "unlimitedStorage"</td>
   <td> Provides an unlimited quota for storing HTML5 client-side data,
-       such as databases and local storage files. 
+       such as databases and local storage files.
        Without this permission, the extension is limited to
        5 MB of local storage.
 
       <p class="note">
       <b>Note:</b>
       This permission applies only to Web SQL Database and application cache
       (see issue <a href="http://crbug.com/58985">58985</a>).
       Also, it doesn't currently work with wildcard subdomains such as
       <code>http://*.example.com</code>.
-      </p>       
+      </p>
   </td>
 <tr>
 <tr>
   <td> "webNavigation" </td>
   <td> Required if the extension uses the
        <a href="webNavigation.html">chrome.webNavigation</a> module. </td>
 </tr>
 <tr>
   <td> "webRequest" </td>
   <td> Required if the extension uses the
@@ skipping 157 matching lines @@
   <code>chrome.extension.getURL</code>
 </a> method. Whitelisted resources are served with appropriate
 <a href="http://www.w3.org/TR/cors/">CORS</a> headers, so they're available via
 mechanisms like XHR.
 </p>
 
 <p>
 Injected content scripts themselves do not need to be whitelisted.
 </p>
 
-<h4>Default Availablility</h4>
+<h4>Default Availability</h4>
 
 <p>
 Resources inside of packages using <a href="#manifest_version">
   <code>manifest_version</code>
 </a> 2 or above are <strong>blocked by default</strong>, and must be whitelisted
 for use via this property.
 </p>
 
 <p>
 Resources inside of packages using <code>manifest_version</code> 1 are available
 by default, but <em>if</em> you do set this property, then it will be treated as
 a complete list of all whitelisted resources. Resources not listed will be
 blocked.
 </p>
 
+<h3 id="sandboxed_resources">sandboxed_resources</h3>
+
+<p>
+An array of strings specifying the paths (relative to the package root) of
+packaged resources that are to be served in a sandboxed unique origin. Being
+in a sandbox has two implications:
+</p>
+
+<ol>
+<li>A sandboxed resource will not have access to extension or app APIs, or
+direct access to non-sandboxed pages (they may communicate via
+<code>postMessage()</code>).</li>
+<li>A sandboxed resource is not subject to the
+<a href="contentSecurityPolicy.html">Content Security Policy (CSP)</a> used
+by the rest of the app or extension. This means that, for example, it can use
+inline script and <code>eval</code>.</li>
+</ol>
+
+<p>
+The sandbox is enforced by using the
+<a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html#attr-iframe-sandbox">HTML5 sandbox</a>
+with the tokens <code>allow-scripts allow-forms</code>.
+</p>
+
+<p>
+Note that you only need to list resources that you expected to be loaded in
+windows or frames. Subresources used by sandboxed pages (e.g. stylesheets or
+JavaScript source files) do not need to appear in the
+<code>sandboxed_resources</code> list, they will use the sandbox of the page
+that embeds them.
+</p>
+
+<p>
+Sandboxed resources may only be specified when using
+<a href="#manifest_version"><code>manifest_version</code></a> 2 or above.
+</p>