chrome/common/extensions/docs/manifest.html - Issue 9212044: Improving `content_security_policy` documentation.

Side by Side Diff: chrome/common/extensions/docs/manifest.html

Issue 9212044: Improving `content_security_policy` documentation. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src

Patch Set: Created 8 years, 11 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

« chrome/common/extensions/docs/contentSecurityPolicy.html ('K') | « chrome/common/extensions/docs/examples/tutorials/analytics/popup.js ('k') | chrome/common/extensions/docs/samples.html » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
1 <!DOCTYPE html><!-- This page is a placeholder for generated extensions api doc. Note:	1 <!DOCTYPE html><!-- This page is a placeholder for generated extensions api doc. Note:

2 1) The <head> information in this page is significant, should be uniform	2 1) The <head> information in this page is significant, should be uniform

3 across api docs and should be edited only with knowledge of the	3 across api docs and should be edited only with knowledge of the

4 templating mechanism.	4 templating mechanism.

5 3) All <body>.innerHTML is genereated as an rendering step. If viewed in a	5 3) All <body>.innerHTML is genereated as an rendering step. If viewed in a

6 browser, it will be re-generated from the template, json schema and	6 browser, it will be re-generated from the template, json schema and

7 authored overview content.	7 authored overview content.

8 4) The <body>.innerHTML is also generated by an offline step so that this	8 4) The <body>.innerHTML is also generated by an offline step so that this

9 page may easily be indexed by search engines.	9 page may easily be indexed by search engines.

10 --><html xmlns="http://www.w3.org/1999/xhtml"><head>	10 --><html xmlns="http://www.w3.org/1999/xhtml"><head>

(...skipping 300 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
311 </li><li>	311 </li><li>

312 <a href="#H2-1">Field details</a>	312 <a href="#H2-1">Field details</a>

313 <ol>	313 <ol>

314 <li>	314 <li>

315 <a href="#app">app</a>	315 <a href="#app">app</a>

316 </li><li>	316 </li><li>

317 <a href="#default_locale">default_locale</a>	317 <a href="#default_locale">default_locale</a>

318 </li><li>	318 </li><li>

319 <a href="#description">description</a>	319 <a href="#description">description</a>

320 </li><li>	320 </li><li>

321 <a href="#content_security_policy">content_security_policy</a>

322 </li><li>

323 <a href="#homepage_url">homepage_url</a>	321 <a href="#homepage_url">homepage_url</a>

324 </li><li>	322 </li><li>

325 <a href="#icons">icons</a>	323 <a href="#icons">icons</a>

326 </li><li>	324 </li><li>

327 <a href="#incognito">incognito</a>	325 <a href="#incognito">incognito</a>

328 </li><li>	326 </li><li>

329 <a href="#key">key</a>	327 <a href="#key">key</a>

330 </li><li>	328 </li><li>

331 <a href="#minimum_chrome_version">minimum_chrome_version</a>	329 <a href="#minimum_chrome_version">minimum_chrome_version</a>

332 </li><li>	330 </li><li>

(...skipping 65 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
398 <em>// Pick one (or none)</em>	396 <em>// Pick one (or none)</em>

399 "<a href="browserAction.html">browser_action</a>": {...},	397 "<a href="browserAction.html">browser_action</a>": {...},

400 "<a href="pageAction.html">page_action</a>": {...},	398 "<a href="pageAction.html">page_action</a>": {...},

401 "<a href="themes.html">theme</a>": {...},	399 "<a href="themes.html">theme</a>": {...},

402 "<a href="#app">app</a>": {...},	400 "<a href="#app">app</a>": {...},

403	401

404 <em>// Add any of these that you need</em>	402 <em>// Add any of these that you need</em>

405 "<a href="background_pages.html">background</a>": {...},	403 "<a href="background_pages.html">background</a>": {...},

406 "<a href="override.html">chrome_url_overrides</a>": {...},	404 "<a href="override.html">chrome_url_overrides</a>": {...},

407 "<a href="content_scripts.html">content_scripts</a>": [...],	405 "<a href="content_scripts.html">content_scripts</a>": [...],

408 "<a href="#content_security_policy">content_security_policy</a>": "<em>policyS tring</em>",	406 "<a href="contentSecurityPolicy.html">content_security_policy</a>": "<em>polic yString</em>",

409 "<a href="fileBrowserHandler.html">file_browser_handlers</a>": [...],	407 "<a href="fileBrowserHandler.html">file_browser_handlers</a>": [...],

410 "<a href="#homepage_url">homepage_url</a>": "http://<em>path/to/homepage</em>" ,	408 "<a href="#homepage_url">homepage_url</a>": "http://<em>path/to/homepage</em>" ,

411 "<a href="#incognito">incognito</a>": "spanning" <em>or</em> "split",	409 "<a href="#incognito">incognito</a>": "spanning" <em>or</em> "split",

412 "<a href="#key">key</a>": "<em>publicKey</em>",	410 "<a href="#key">key</a>": "<em>publicKey</em>",

413 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt ring</em>",	411 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt ring</em>",

414 "<a href="#nacl_modules">nacl_modules</a>": [...],	412 "<a href="#nacl_modules">nacl_modules</a>": [...],

415 "<a href="#offline_enabled">offline_enabled</a>": true,	413 "<a href="#offline_enabled">offline_enabled</a>": true,

416 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" },	414 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" },

417 "<a href="options.html">options_page</a>": "<em>aFile</em>.html",	415 "<a href="options.html">options_page</a>": "<em>aFile</em>.html",

418 "<a href="#permissions">permissions</a>": [...],	416 "<a href="#permissions">permissions</a>": [...],

(...skipping 51 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
470 (no HTML or other formatting;	468 (no HTML or other formatting;

471 no more than 132 characters)	469 no more than 132 characters)

472 that describes the extension.	470 that describes the extension.

473 The description should be suitable for both	471 The description should be suitable for both

474 the browser's extension management UI	472 the browser's extension management UI

475 and the <a href="https://chrome.google.com/webstore">Chrome Web Store</a>.	473 and the <a href="https://chrome.google.com/webstore">Chrome Web Store</a>.

476 You can specify locale-specific strings for this field;	474 You can specify locale-specific strings for this field;

477 see <a href="i18n.html">Internationalization</a> for details.	475 see <a href="i18n.html">Internationalization</a> for details.

478 </p>	476 </p>

479	477

480 <h3 id="content_security_policy">content_security_policy</h3>

481

482 <p>

483 A security policy to apply to resources in your extension. You can use this

484 policy to help prevent cross-site scripting vulnerabilities in your extension.

485 By default, the extension system enforces the following policy:

486 </p>

487

488 <pre>script-src 'self'; object-src 'self'</pre>

489

490 <p>

491 Extensions can tighten their policy using the

492 <code>content_security_policy</code> manifest attribute. For example, to

493 specify that your extension loads resources only from its own package, use the

494 following policy:

495 </p>

496

497 <pre>"content_security_policy": "default-src 'self' " </pre>

498

499 <p>

500 If you need to load resources from websites,

501 you can add them to the whitelist.

502 For example, if your extension uses Google Analytics,

503 you might use the following policy:

504 </p>

505

506 <pre>"content_security_policy": "default-src 'self' https://ssl.google-analytics .com"</pre>

507

508 <p>

509 The extension system will prevent you including insecure resources

510 for <code>script-src</code> or <code>object-src</code>. If you are using

511 <code>eval</code> to parse JSON, please consider using <code>JSON.parse</code>

512 instead.

513 </p>

514

515 <p>

516 For details, see the

517 <a href="http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specific ation.dev.html">Content Security Policy specification</a>.

518 </p>

519

520

521 <h3 id="homepage_url">homepage_url</h3>	478 <h3 id="homepage_url">homepage_url</h3>

522	479

523 <p>	480 <p>

524 The URL of the homepage for this extension. The extensions management page (chro me://extensions)	481 The URL of the homepage for this extension. The extensions management page (chro me://extensions)

525 will contain a link to this URL. This field is particularly useful if you	482 will contain a link to this URL. This field is particularly useful if you

526 <a href="hosting.html">host the extension on your own site</a>. If you distribut e your	483 <a href="hosting.html">host the extension on your own site</a>. If you distribut e your

527 extension using the <a href="https://chrome.google.com/webstore">Chrome Web Stor e</a>,	484 extension using the <a href="https://chrome.google.com/webstore">Chrome Web Stor e</a>,

528 the homepage URL defaults to the extension's own page.	485 the homepage URL defaults to the extension's own page.

529 </p>	486 </p>

530	487

(...skipping 762 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
1293 _uff=0;	1250 _uff=0;

1294 urchinTracker();	1251 urchinTracker();

1295 }	1252 }

1296 catch(e) {/* urchinTracker not available. */}	1253 catch(e) {/* urchinTracker not available. */}

1297 </script>	1254 </script>

1298 <!-- end analytics -->	1255 <!-- end analytics -->

1299 </div>	1256 </div>

1300 </div> <!-- /gc-footer -->	1257 </div> <!-- /gc-footer -->

1301 </div> <!-- /gc-container -->	1258 </div> <!-- /gc-container -->

1302 </body></html>	1259 </body></html>

OLD	NEW