OLD | NEW |
1 <h1>Formats: Manifest Files</h1> | 1 <h1>Formats: Manifest Files</h1> |
2 | 2 |
3 | 3 |
4 <p> | 4 <p> |
5 Every extension, installable web app, and theme has a | 5 Every extension, installable web app, and theme has a |
6 <a href="http://www.json.org">JSON</a>-formatted manifest file, | 6 <a href="http://www.json.org">JSON</a>-formatted manifest file, |
7 named <code>manifest.json</code>, | 7 named <code>manifest.json</code>, |
8 that provides important information. | 8 that provides important information. |
9 </p> | 9 </p> |
10 | 10 |
11 <h2 id="overview"> Field summary </h2> | 11 <h2 id="overview"> Field summary </h2> |
12 | 12 |
13 <p> | 13 <p> |
14 The following code shows the supported manifest fields, | 14 The following code shows the supported manifest fields, |
15 with links to the page that discusses each field. | 15 with links to the page that discusses each field. |
16 The only fields that are always required | 16 The only fields that are always required |
17 are <b>name</b> and <b>version</b>. | 17 are <b>name</b> and <b>version</b>. |
18 </p> | 18 </p> |
19 | 19 |
20 <pre> | 20 <pre> |
21 { | 21 { |
22 <em>// Required</em> | 22 <em>// Required</em> |
23 "<a href="#name">name</a>": "<em>My Extension</em>", | 23 {{#manifest_json.extensions_manifest.required}} |
24 "<a href="#version">version</a>": "<em>versionString</em>", | 24 "<a href="{{documentation}}">{{name}}</a>": <em>{{*example}}</em>, |
25 "<a href="#manifest_version">manifest_version</a>": 2, | 25 {{/}} |
26 | 26 |
27 <em>// Recommended</em> | 27 <em>// Recommended</em> |
28 "<a href="#description">description</a>": "<em>A plain text description</em>", | 28 {{#manifest_json.extensions_manifest.recommended}} |
29 "<a href="#icons">icons</a>": { ... }, | 29 "<a href="{{documentation}}">{{name}}</a>": <em>{{*example}}</em>, |
30 "<a href="#default_locale">default_locale</a>": "<em>en</em>", | 30 {{/}} |
31 | 31 |
32 <em>// Pick one (or none)</em> | 32 <em>// Pick one (or none)</em> |
33 "<a href="browserAction.html">browser_action</a>": {...}, | 33 {{#manifest_json.extensions_manifest.only_one}} |
34 "<a href="pageAction.html">page_action</a>": {...}, | 34 "<a href="{{documentation}}">{{name}}</a>": <em>{{*example}}</em>, |
35 "<a href="themes.html">theme</a>": {...}, | 35 {{/}} |
36 "<a href="#app">app</a>": {...}, | |
37 | 36 |
38 <em>// Add any of these that you need</em> | 37 <em>// Add any of these that you need</em> |
39 "<a href="event_pages.html">background</a>": {"persistent": false, ...}, | 38 {{#manifest_json.extensions_manifest.optional}} |
40 "<a href="background_pages.html">background</a>": {"persistent": true, ...}, | 39 "<a href="{{documentation}}">{{name}}</a>": <em>{{*example}}</em>, |
41 "<a href="override.html">chrome_url_overrides</a>": {...}, | 40 {{/}} |
42 "<a href="content_scripts.html">content_scripts</a>": [...], | |
43 "<a href="../extensions/contentSecurityPolicy.html">content_security_policy</a
>": "<em>policyString</em>", | |
44 "<a href="fileBrowserHandler.html">file_browser_handlers</a>": [...], | |
45 "<a href="#file_handlers">file_handlers</a>": {...}, | |
46 "<a href="#homepage_url">homepage_url</a>": "http://<em>path/to/homepage</em>"
, | |
47 "<a href="#incognito">incognito</a>": "spanning" <em>or</em> "split", | |
48 "<a href="#key">key</a>": "<em>publicKey</em>", | |
49 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt
ring</em>", | |
50 | |
51 "<a href="#nacl_modules">nacl_modules</a>": [...], | |
52 "<a href="#kiosk_enabled">kiosk_enabled</a>": true, | |
53 "<a href="#offline_enabled">offline_enabled</a>": true, | |
54 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" }, | |
55 "<a href="options.html">options_page</a>": "<em>aFile</em>.html", | |
56 "<a href="declare_permissions.html">permissions</a>": [...], | |
57 "<a href="npapi.html">plugins</a>": [...], | |
58 "<a href="#requirements">requirements</a>": {...}, | |
59 "<a href="autoupdate.html">update_url</a>": "http://<em>path/to/updateInfo</em
>.xml", | |
60 "<a href="#web_accessible_resources">web_accessible_resources</a>": [...], | |
61 "<a href="#sandbox">sandbox</a>": [...] | |
62 } | 41 } |
63 </pre> | 42 </pre> |
64 | |
65 | |
66 <h2 id="field_details">Field details</h2> | |
67 | |
68 <p> | |
69 This section covers fields that aren't described in another page. | |
70 For a complete list of fields, | |
71 with links to where they're described in detail, | |
72 see the <a href="#overview">Field summary</a>. | |
73 </p> | |
74 | |
75 | |
76 <h3 id="app">app</h3> | |
77 | |
78 <p> | |
79 Used by <a href="../apps/app_lifecycle.html#eventpage">packaged apps</a> | |
80 to specify the app's background scripts. | |
81 Also used by <a href="https://developers.google.com/chrome/apps/docs/developers_
guide#live">hosted apps</a> | |
82 to specify the URLs that the app uses. | |
83 </p> | |
84 | |
85 <h3 id="default_locale">default_locale</h3> | |
86 | |
87 <p> | |
88 Specifies the subdirectory of <code>_locales</code> | |
89 that contains the default strings for this extension. | |
90 This field is <b>required</b> in extensions | |
91 that have a <code>_locales</code> directory; | |
92 it <b>must be absent</b> in extensions | |
93 that have no <code>_locales</code> directory. | |
94 For details, see | |
95 <a href="i18n.html">Internationalization</a>. | |
96 </p> | |
97 | |
98 <h3 id="description">description</h3> | |
99 | |
100 <p> | |
101 A plain text string | |
102 (no HTML or other formatting; | |
103 no more than 132 characters) | |
104 that describes the extension. | |
105 The description should be suitable for both | |
106 the browser's extension management UI | |
107 and the <a href="https://chrome.google.com/webstore">Chrome Web Store</a>. | |
108 You can specify locale-specific strings for this field; | |
109 see <a href="i18n.html">Internationalization</a> for details. | |
110 </p> | |
111 | |
112 <h3 id="file_handlers">file_handlers</h3> | |
113 | |
114 <p> | |
115 Used by <a href="../apps/app_lifecycle.html#eventpage">packaged apps</a> | |
116 to specify what types of files the app can handle. An app can have multiple <cod
e>file_handlers</code>, with each one having an identifier, a list of MIME types
that can be handled, and | |
117 a title. Here's an example of specifying file handlers: | |
118 </p> | |
119 | |
120 <pre> | |
121 "file_handlers": { | |
122 "text": { | |
123 "types": [ | |
124 "text/*" | |
125 ], | |
126 "title": "Text editor" | |
127 }, | |
128 "image": { | |
129 "types": [ | |
130 "image/png", | |
131 "image/jpeg" | |
132 ], | |
133 "title": "Image editor" | |
134 } | |
135 } | |
136 </pre> | |
137 | |
138 <p> | |
139 To handle files, apps also need to declare the $ref:fileSystem | |
140 permission. Apps can then be passed files in the $ref:app.runtime.onLaunched | |
141 event - either from the system | |
142 file manager (currently supported on ChromeOS only) or by providing | |
143 a path on the <a href="../apps/first_app.html#open">command line</a>. | |
144 </p> | |
145 | |
146 <h3 id="homepage_url">homepage_url</h3> | |
147 | |
148 <p> | |
149 The URL of the homepage for this extension. The extensions management page (chro
me://extensions) | |
150 will contain a link to this URL. This field is particularly useful if you | |
151 <a href="hosting.html">host the extension on your own site</a>. If you distribut
e your | |
152 extension using the <a href="https://chrome.google.com/webstore">Chrome Web Stor
e</a>, | |
153 the homepage URL defaults to the extension's own page. | |
154 </p> | |
155 | |
156 <h3 id="icons">icons</h3> | |
157 | |
158 <p> | |
159 One or more icons that represent the extension, app, or theme. | |
160 You should always provide a 128x128 icon; | |
161 it's used during installation and by the Chrome Web Store. | |
162 Extensions should also provide a 48x48 icon, | |
163 which is used in the extensions management page | |
164 (chrome://extensions). | |
165 You can also specify a 16x16 icon to be used as the favicon | |
166 for an extension's pages. | |
167 The 16x16 icon is also displayed in the experimental extension | |
168 <a href="experimental.infobars.html">infobar</a> | |
169 feature. | |
170 </p> | |
171 | |
172 <p> | |
173 Icons should generally be in PNG format, | |
174 because PNG has the best support for transparency. | |
175 They can, however, be in any format supported by WebKit, | |
176 including BMP, GIF, ICO, and JPEG. | |
177 Here's an example of specifying the icons: | |
178 </p> | |
179 | |
180 <pre> | |
181 "icons": { "16": "icon16.png", | |
182 "48": "icon48.png", | |
183 "128": "icon128.png" }, | |
184 </pre> | |
185 | |
186 <p class="note"> | |
187 You may provide icons of any other size you wish, and Chrome will attempt to use | |
188 the best size where appropriate. For example, Windows often requires 32-pixel | |
189 icons, and if the app includes a 32-pixel icon, Chrome will choose that instead | |
190 of shrinking a 48-pixel icon down. However, you should ensure that all of your | |
191 icons are square, or unexpected behavior may result. | |
192 </p> | |
193 | |
194 <p> | |
195 If you upload your extension, app, or theme using the | |
196 <a href="https://chrome.google.com/webstore/developer/dashboard">Chrome Develope
r Dashboard</a>, | |
197 you'll need to upload additional images, | |
198 including at least one screenshot of your extension. | |
199 For more information, | |
200 see the | |
201 <a href="http://code.google.com/chrome/webstore/">Chrome Web Store | |
202 developer documentation</a>. | |
203 </p> | |
204 | |
205 <h3 id="incognito">incognito</h3> | |
206 | |
207 <p> | |
208 Either "spanning" or "split", to specify how this extension will | |
209 behave if allowed to run in incognito mode. | |
210 </p> | |
211 | |
212 <p> | |
213 The default for extensions is "spanning", which means that the extension | |
214 will run in a single shared process. Any events or messages from an incognito | |
215 tab will be sent to the shared process, with an <em>incognito</em> flag | |
216 indicating where it came from. Because incognito tabs cannot use this shared | |
217 process, an extension using the "spanning" incognito mode will not be able to | |
218 load pages from its extension package into the main frame of an incognito tab. | |
219 </p> | |
220 | |
221 <p> | |
222 The default for installable web apps is "split", | |
223 which means that all app pages in | |
224 an incognito window will run in their own incognito process. If the app or exten
sion contains a background page, that will also run in the incognito process. | |
225 This incognito process runs along side the regular process, but has a separate | |
226 memory-only cookie store. Each process sees events and messages only from its | |
227 own context (for example, the incognito process will see only incognito tab upda
tes). | |
228 The processes are unable to communicate with each other. | |
229 </p> | |
230 | |
231 <p> | |
232 As a rule of thumb, if your extension or app needs to load a tab in an incognito
browser, use | |
233 <em>split</em> incognito behavior. If your extension or app needs to be logged | |
234 into a remote server or persist settings locally, use <em>spanning</em> | |
235 incognito behavior. | |
236 </p> | |
237 | |
238 <h3 id="key">key</h3> | |
239 | |
240 <p> | |
241 This value can be used to control | |
242 the unique ID of an extension, app, or theme when | |
243 it is loaded during development. | |
244 </p> | |
245 | |
246 <p class="note"> | |
247 <b>Note:</b> You don't usually need to | |
248 use this value. Instead, write your | |
249 code so that the key value doesn't matter | |
250 by using <a href="overview.html#relative-urls">relative paths</a> | |
251 and $ref:runtime.getURL. | |
252 </p> | |
253 | |
254 <p> | |
255 To get a suitable key value, first | |
256 install your extension from a <code>.crx</code> file | |
257 (you may need to | |
258 <a href="https://chrome.google.com/webstore/developer/dashboard">upload your ext
ension</a> | |
259 or <a href="packaging.html">package it manually</a>). | |
260 Then, in your | |
261 <a href="http://www.chromium.org/user-experience/user-data-directory">user | |
262 data directory</a>, look in the file | |
263 <code>Default/Extensions/<em><extensionId></em>/<em><versionString><
/em>/manifest.json</code>. | |
264 You will see the key value filled in there. | |
265 </p> | |
266 | |
267 <h3 id="minimum_chrome_version">minimum_chrome_version</h3> | |
268 | |
269 <p> | |
270 The version of Chrome that your extension, app, or theme requires, if any. | |
271 The format for this string is the same as for the | |
272 <a href="#version">version</a> field. | |
273 | |
274 <h3 id="name">name</h3> | |
275 | |
276 <p> | |
277 A short, plain text string | |
278 (no more than 45 characters) | |
279 that identifies the extension. | |
280 The name is used in the install dialog, | |
281 extension management UI, | |
282 and the <a href="https://chrome.google.com/webstore">store</a>. | |
283 You can specify locale-specific strings for this field; | |
284 see <a href="i18n.html">Internationalization</a> for details. | |
285 </p> | |
286 | |
287 <h3 id="nacl_modules">nacl_modules</h3> | |
288 | |
289 <p> | |
290 One or more mappings from MIME types to the Native Client module | |
291 that handles each type. | |
292 For example, the bold code in the following snippet | |
293 registers a Native Client module as the content handler | |
294 for the OpenOffice spreadsheet MIME type. | |
295 </p> | |
296 | |
297 <pre> | |
298 { | |
299 "name": "Native Client OpenOffice Spreadsheet Viewer", | |
300 "version": "0.1", | |
301 "description": "Open OpenOffice spreadsheets, right in your browser.", | |
302 <b>"nacl_modules": [{ | |
303 "path": "OpenOfficeViewer.nmf", | |
304 "mime_type": "application/vnd.oasis.opendocument.spreadsheet" | |
305 }]</b> | |
306 } | |
307 </pre> | |
308 | |
309 <p> | |
310 The value of "path" is the location of a Native Client manifest | |
311 (a <code>.nmf</code> file) | |
312 within the extension directory. | |
313 For more information on Native Client and <code>.nmf</code> files, see the | |
314 <a href="http://code.google.com/chrome/nativeclient/docs/technical_overview.html
">Native Client Technical Overview</a>. | |
315 </p> | |
316 | |
317 <p> | |
318 Each MIME type can be associated with only one <code>.nmf</code> file, | |
319 but a single <code>.nmf</code> file might handle multiple MIME types. | |
320 The following example shows an extension | |
321 with two <code>.nmf</code> files | |
322 that handle three MIME types. | |
323 </p> | |
324 | |
325 <pre> | |
326 { | |
327 "name": "Spreadsheet Viewer", | |
328 "version": "0.1", | |
329 "description": "Open OpenOffice and Excel spreadsheets, right in your browser.
", | |
330 "nacl_modules": [{ | |
331 "path": "OpenOfficeViewer.nmf", | |
332 "mime_type": "application/vnd.oasis.opendocument.spreadsheet" | |
333 }, | |
334 { | |
335 "path": "OpenOfficeViewer.nmf", | |
336 "mime_type": "application/vnd.oasis.opendocument.spreadsheet-template" | |
337 }, | |
338 { | |
339 "path": "ExcelViewer.nmf", | |
340 "mime_type": "application/excel" | |
341 }] | |
342 } | |
343 </pre> | |
344 | |
345 <p class="note"> | |
346 <strong>Note:</strong> | |
347 You can use Native Client modules in extensions | |
348 without specifying "nacl_modules". | |
349 Use "nacl_modules" only if you want the browser | |
350 to use your Native Client module | |
351 to display a particular type of content. | |
352 </p> | |
353 | |
354 <h3 id="kiosk_enabled">kiosk_enabled</h3> | |
355 | |
356 <p> | |
357 Whether the packaged app is designed to expected to work in ChromeOS kiosk mode. | |
358 In kiosk mode, the platform app window will cover the entire surface of the | |
359 display (forced full screen). The kiosk-enabled apps are expected to be designed | |
360 with this constraint in mind. | |
361 </p> | |
362 | |
363 <h3 id="offline_enabled">offline_enabled</h3> | |
364 | |
365 <p> | |
366 Whether the app or extension is expected to work offline. When Chrome detects | |
367 that it is offline, apps with this field set to true will be highlighted | |
368 on the New Tab page. | |
369 </p> | |
370 | |
371 <h3 id="requirements">requirements</h3> | |
372 | |
373 <p> | |
374 Technologies required by the app or extension. | |
375 Hosting sites such as the Chrome Web Store may use this list | |
376 to dissuade users from installing apps or extensions | |
377 that will not work on their computer. | |
378 Supported requirements currently include "3D" and "plugins"; | |
379 additional requirements checks may be added in the future. | |
380 </p> | |
381 | |
382 <p> | |
383 The "3D" requirement denotes GPU hardware acceleration. | |
384 The "webgl" requirement refers to the | |
385 <a href="http://www.khronos.org/webgl/">WebGL API</a>. | |
386 For more information on Chrome 3D graphics support, | |
387 see the help article on | |
388 <a href="http://www.google.com/support/chrome/bin/answer.py?answer=1220892">WebG
L and 3D graphics</a>. | |
389 You can list the 3D-related features your app requires, | |
390 as demonstrated in the following example: | |
391 </p> | |
392 | |
393 <pre> | |
394 "requirements": { | |
395 "3D": { | |
396 "features": ["webgl"] | |
397 } | |
398 } | |
399 </pre> | |
400 | |
401 <p> | |
402 The "plugins" requirement indicates | |
403 if an app or extension requires NPAPI to run. | |
404 This requirement is enabled by default | |
405 when the manifest includes the | |
406 <a href="http://developer.chrome.com/extensions/npapi.html">"plugins" field</a>.
| |
407 For apps and extensions that still work when plugins aren't available, | |
408 you can disable this requirement | |
409 by setting NPAPI to false. | |
410 You can also enable this requirement manually, | |
411 by setting NPAPI to true, | |
412 as shown in this example: | |
413 </p> | |
414 | |
415 <pre> | |
416 "requirements": { | |
417 "plugins": { | |
418 "npapi": true | |
419 } | |
420 } | |
421 </pre> | |
422 | |
423 | |
424 <h3 id="version">version</h3> | |
425 | |
426 <p> | |
427 One to four dot-separated integers | |
428 identifying the version of this extension. | |
429 A couple of rules apply to the integers: | |
430 they must be between 0 and 65535, inclusive, | |
431 and non-zero integers can't start with 0. | |
432 For example, 99999 and 032 are both invalid. | |
433 </p> | |
434 | |
435 <p> | |
436 Here are some examples of valid versions: | |
437 </p> | |
438 | |
439 <ul> | |
440 <li> <code>"version": "1"</code> </li> | |
441 <li> <code>"version": "1.0"</code> </li> | |
442 <li> <code>"version": "2.10.2"</code> </li> | |
443 <li> <code>"version": "3.1.2.4567"</code> </li> | |
444 </ul> | |
445 | |
446 <p> | |
447 The autoupdate system compares versions | |
448 to determine whether an installed extension | |
449 needs to be updated. | |
450 If the published extension has a newer version string | |
451 than the installed extension, | |
452 then the extension is automatically updated. | |
453 </p> | |
454 | |
455 <p> | |
456 The comparison starts with the leftmost integers. | |
457 If those integers are equal, | |
458 the integers to the right are compared, | |
459 and so on. | |
460 For example, 1.2.0 is a newer version than 1.1.9.9999. | |
461 </p> | |
462 | |
463 <p> | |
464 A missing integer is equal to zero. | |
465 For example, 1.1.9.9999 is newer than 1.1. | |
466 </p> | |
467 | |
468 <p> | |
469 For more information, see | |
470 <a href="autoupdate.html">Autoupdating</a>. | |
471 </p> | |
472 | |
473 | |
474 | |
475 <h3 id="manifest_version">manifest_version</h3> | |
476 | |
477 <p> | |
478 One integer specifying the version of the manifest file format your package | |
479 requires. As of Chrome 18, developers <em>should</em> specify <code>2</code> | |
480 (without quotes) to use the format as described by this document: | |
481 </p> | |
482 | |
483 <pre>"manifest_version": 2</pre> | |
484 | |
485 <p> | |
486 Consider manifest version 1 <em>deprecated</em> as of Chrome 18. Version 2 is | |
487 not yet <em>required</em>, but we will, at some point in the not-too-distant | |
488 future, stop supporting packages using deprecated manifest versions. Extensions, | |
489 applications, and themes that aren't ready to make the jump to the new manifest | |
490 version in Chrome 18 can either explicitly specify version <code>1</code>, or | |
491 leave the key off entirely. | |
492 </p> | |
493 | |
494 <p> | |
495 The changes between version 1 and version 2 of the manifest file format are | |
496 described in detail in <a href="manifestVersion.html">the | |
497 <code>manifest_version</code> documentation.</a> | |
498 </p> | |
499 | |
500 <p class="caution"> | |
501 Setting <code>manifest_version</code> 2 in Chrome 17 or lower is not | |
502 recommended. If your extension needs to work in older versions of Chrome, | |
503 stick with version 1 for the moment. We'll give you ample warning before | |
504 version 1 stops working. | |
505 </p> | |
506 | |
507 <h3 id="web_accessible_resources">web_accessible_resources</h3> | |
508 | |
509 <p> | |
510 An array of strings specifying the paths (relative to the package root) of | |
511 packaged resources that are expected to be usable in the context of a web page. | |
512 For example, an extension that injects a content script with the intention of | |
513 building up some custom interface for <code>example.com</code> would whitelist | |
514 any resources that interface requires (images, icons, stylesheets, scripts, | |
515 etc.) as follows: | |
516 </p> | |
517 | |
518 <pre>{ | |
519 ... | |
520 "web_accessible_resources": [ | |
521 "images/my-awesome-image1.png", | |
522 "images/my-amazing-icon1.png", | |
523 "style/double-rainbow.css", | |
524 "script/double-rainbow.js" | |
525 ], | |
526 ... | |
527 }</pre> | |
528 | |
529 <p> | |
530 These resources would then be available in a webpage via the URL | |
531 <code>chrome-extension://[PACKAGE ID]/[PATH]</code>, which can be generated with | |
532 the $ref:runtime.getURL method. Whitelisted resources are served with appropriat
e | |
533 <a href="http://www.w3.org/TR/cors/">CORS</a> headers, so they're available via | |
534 mechanisms like XHR. | |
535 </p> | |
536 | |
537 <p> | |
538 Injected content scripts themselves do not need to be whitelisted. | |
539 </p> | |
540 | |
541 <p> | |
542 Prior to manifest version 2 all resources within an extension could be accessed | |
543 from any page on the web. This allowed a malicious website to | |
544 <a href="http://en.wikipedia.org/wiki/Device_fingerprint">fingerprint</a> the | |
545 extensions that a user has installed or exploit vulnerabilities (for example | |
546 <a href="http://en.wikipedia.org/wiki/Cross-site_scripting">XSS bugs</a>)within | |
547 installed extensions. Limiting availability to only resources which are | |
548 explicitly intended to be web accessible serves to both minimize the available | |
549 attack surface and protect the privacy of users. | |
550 </p> | |
551 | |
552 <h4 id="availability">Default Availability</h4> | |
553 | |
554 <p> | |
555 Resources inside of packages using <a href="#manifest_version"><code>manifest_ve
rsion</code></a> | |
556 2 or above are <strong>blocked by default</strong>, and must be whitelisted | |
557 for use via this property. | |
558 </p> | |
559 | |
560 <p> | |
561 Resources inside of packages using <code>manifest_version</code> 1 are available | |
562 by default, but <em>if</em> you do set this property, then it will be treated as | |
563 a complete list of all whitelisted resources. Resources not listed will be | |
564 blocked. | |
565 </p> | |
566 | |
567 <h3 id="sandbox">sandbox</h3> | |
568 | |
569 <p> | |
570 Defines an collection of app or extension pages that are to be served | |
571 in a sandboxed unique origin, and optionally a Content Security Policy to use | |
572 with them. Being in a sandbox has two implications: | |
573 </p> | |
574 | |
575 <ol> | |
576 <li>A sandboxed page will not have access to extension or app APIs, or | |
577 direct access to non-sandboxed pages (it may communicate with them via | |
578 <code>postMessage()</code>).</li> | |
579 <li> | |
580 <p>A sandboxed page is not subject to the | |
581 <a href="../extensions/contentSecurityPolicy.html">Content Security Policy | |
582 (CSP)</a> used by the rest of the app or extension (it has its own separate | |
583 CSP value). This means that, for example, it can use inline script and | |
584 <code>eval</code>.</p> | |
585 | |
586 <p>For example, here's how to specify that two extension pages are to be | |
587 served in a sandbox with a custom CSP:</p> | |
588 | |
589 <pre>{ | |
590 ... | |
591 "sandbox": { | |
592 "pages": [ | |
593 "page1.html", | |
594 "directory/page2.html" | |
595 ] | |
596 <i>// content_security_policy is optional.</i> | |
597 "content_security_policy": | |
598 "sandbox allow-scripts; script-src https://www.google.com" | |
599 ], | |
600 ... | |
601 }</pre> | |
602 | |
603 <p> | |
604 If not specified, the default <code>content_security_policy</code> value is | |
605 <code>sandbox allow-scripts allow-forms</code>. You can specify your CSP | |
606 value to restrict the sandbox even further, but it must have the <code>sandbox
</code> | |
607 directive and may not have the <code>allow-same-origin</code> token (see | |
608 <a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/the-ifram
e-element.html#attr-iframe-sandbox">the | |
609 HTML5 specification</a> for possible sandbox tokens). | |
610 </p> | |
611 </li> | |
612 </ol> | |
613 | |
614 <p> | |
615 Note that you only need to list pages that you expected to be loaded in | |
616 windows or frames. Resources used by sandboxed pages (e.g. stylesheets or | |
617 JavaScript source files) do not need to appear in the | |
618 <code>sandboxed_page</code> list, they will use the sandbox of the page | |
619 that embeds them. | |
620 </p> | |
621 | |
622 <p> | |
623 <a href="sandboxingEval.html">"Using eval in Chrome Extensions. Safely."</a> | |
624 goes into more detail about implementing a sandboxing workflow that enables use | |
625 of libraries that would otherwise have issues executing under extension's | |
626 <a href="../extensions/contentSecurityPolicy.html">default Content Security | |
627 Policy</a>. | |
628 </p> | |
629 | |
630 <p> | |
631 Sandboxed page may only be specified when using | |
632 <a href="#manifest_version"><code>manifest_version</code></a> 2 or above. | |
633 </p> | |
OLD | NEW |