chrome/common/extensions/docs/extensions/contentSecurityPolicy.html - Issue 10823074: Adding `chrome-extension` resources to the CSP relaxation documentation.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Unified Diff: chrome/common/extensions/docs/extensions/contentSecurityPolicy.html

Issue 10823074: Adding `chrome-extension` resources to the CSP relaxation documentation. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src

Patch Set: Created 8 years, 5 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

« no previous file with comments | « no previous file | chrome/common/extensions/docs/static/contentSecurityPolicy.html » ('j') | chrome/common/extensions/docs/static/contentSecurityPolicy.html » ('J')
Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

Index: chrome/common/extensions/docs/extensions/contentSecurityPolicy.html

diff --git a/chrome/common/extensions/docs/extensions/contentSecurityPolicy.html b/chrome/common/extensions/docs/extensions/contentSecurityPolicy.html

index d069689528dec625ba52e47c7c8c33db5c091705..d3840254310221177cc5e7b6be9e0acd76b1ff23 100644

--- a/chrome/common/extensions/docs/extensions/contentSecurityPolicy.html

+++ b/chrome/common/extensions/docs/extensions/contentSecurityPolicy.html

@@ -405,13 +405,15 @@ popup.html:

<p>

If, on the other hand, you have a need for some external JavaScript or object

resources, you can relax the policy to a limited extent by whitelisting

- specific HTTPS origins from which scripts should be accepted. Whitelisting

- insecure HTTP resources will have no effect. This is intentional, because

- we want to ensure that executable resources loaded with an extension's

- elevated permissions is exactly the resource you expect, and hasn't been

- replaced by an active network attacker. As <a href="http://en.wikipedia.org/wiki/Man-in-the-middle_attack">man-in-the-middle

- attacks</a> are both trivial and undetectable over HTTP, only HTTPS origins

- will be accepted.

+ secure origins from which scripts should be accepted. We want to ensure that

+ executable resources loaded with an extension's elevated permissions are

+ exactly the resources you expect, and haven't been replaced by an active

+ network attacker. As <a href="http://en.wikipedia.org/wiki/Man-in-the-middle_attack">man-in-the-middle

+ attacks</a> are both trivial and undetectable over HTTP, those origins will

+ not be accepted. <code>HTTPS</code>, on the other hand, secures the resources'

+ transport over the network, so we allow those origins in a relaxed policy.

+ <code>chrome-extension</code> and <code>chrome-extension-resource</code>

+ resources never touch the network, so they're allowed as well.

</p>

<p>

A relaxed policy definition which allows script resources to be loaded from