| OLD | NEW |
| 1 <h1>Formats: Manifest Files</h1> | 1 <h1>Formats: Manifest Files</h1> |
| 2 | 2 |
| 3 | 3 |
| 4 <p> | 4 <p> |
| 5 Every extension, installable web app, and theme has a | 5 Every extension, installable web app, and theme has a |
| 6 <a href="http://www.json.org">JSON</a>-formatted manifest file, | 6 <a href="http://www.json.org">JSON</a>-formatted manifest file, |
| 7 named <code>manifest.json</code>, | 7 named <code>manifest.json</code>, |
| 8 that provides important information. | 8 that provides important information. |
| 9 </p> | 9 </p> |
| 10 | 10 |
| 11 <h2 id="overview"> Field summary </h2> | 11 <h2 id="overview"> Field summary </h2> |
| 12 | 12 |
| 13 <p> | 13 <p> |
| 14 The following code shows the supported manifest fields, | 14 The following code shows the supported manifest fields, |
| 15 with links to the page that discusses each field. | 15 with links to the page that discusses each field. |
| 16 The only fields that are always required | 16 The only fields that are always required |
| 17 are <b>name</b> and <b>version</b>. | 17 are <b>name</b> and <b>version</b>. |
| 18 </p> | 18 </p> |
| 19 | 19 |
| 20 <pre> | 20 <pre> |
| 21 { | 21 { |
| 22 <em>// Required</em> | 22 <em>// Required</em> |
| 23 "<a href="#name">name</a>": "<em>My Extension</em>", | 23 {{#manifest_json.extensions_manifest.required}} |
| 24 "<a href="#version">version</a>": "<em>versionString</em>", | 24 "<a href="{{documentation}}">{{name}}</a>": <em>{{*example}}</em>, |
| 25 "<a href="#manifest_version">manifest_version</a>": 2, | 25 {{/}} |
| 26 | 26 |
| 27 <em>// Recommended</em> | 27 <em>// Recommended</em> |
| 28 "<a href="#description">description</a>": "<em>A plain text description</em>", | 28 {{#manifest_json.extensions_manifest.recommended}} |
| 29 "<a href="#icons">icons</a>": { ... }, | 29 "<a href="{{documentation}}">{{name}}</a>": <em>{{*example}}</em>, |
| 30 "<a href="#default_locale">default_locale</a>": "<em>en</em>", | 30 {{/}} |
| 31 | 31 |
| 32 <em>// Pick one (or none)</em> | 32 <em>// Pick one (or none)</em> |
| 33 "<a href="browserAction.html">browser_action</a>": {...}, | 33 {{#manifest_json.extensions_manifest.only_one}} |
| 34 "<a href="pageAction.html">page_action</a>": {...}, | 34 "<a href="{{documentation}}">{{name}}</a>": <em>{{*example}}</em>, |
| 35 "<a href="themes.html">theme</a>": {...}, | 35 {{/}} |
| 36 "<a href="#app">app</a>": {...}, | |
| 37 | 36 |
| 38 <em>// Add any of these that you need</em> | 37 <em>// Add any of these that you need</em> |
| 39 "<a href="event_pages.html">background</a>": {"persistent": false, ...}, | 38 {{#manifest_json.extensions_manifest.optional}} |
| 40 "<a href="background_pages.html">background</a>": {"persistent": true, ...}, | 39 "<a href="{{documentation}}">{{name}}</a>": <em>{{*example}}</em>, |
| 41 "<a href="override.html">chrome_url_overrides</a>": {...}, | 40 {{/}} |
| 42 "<a href="content_scripts.html">content_scripts</a>": [...], | |
| 43 "<a href="../extensions/contentSecurityPolicy.html">content_security_policy</a
>": "<em>policyString</em>", | |
| 44 "<a href="fileBrowserHandler.html">file_browser_handlers</a>": [...], | |
| 45 "<a href="#file_handlers">file_handlers</a>": {...}, | |
| 46 "<a href="#homepage_url">homepage_url</a>": "http://<em>path/to/homepage</em>"
, | |
| 47 "<a href="#incognito">incognito</a>": "spanning" <em>or</em> "split", | |
| 48 "<a href="#key">key</a>": "<em>publicKey</em>", | |
| 49 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt
ring</em>", | |
| 50 | |
| 51 "<a href="#nacl_modules">nacl_modules</a>": [...], | |
| 52 "<a href="#kiosk_enabled">kiosk_enabled</a>": true, | |
| 53 "<a href="#offline_enabled">offline_enabled</a>": true, | |
| 54 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" }, | |
| 55 "<a href="options.html">options_page</a>": "<em>aFile</em>.html", | |
| 56 "<a href="declare_permissions.html">permissions</a>": [...], | |
| 57 "<a href="npapi.html">plugins</a>": [...], | |
| 58 "<a href="#requirements">requirements</a>": {...}, | |
| 59 "<a href="autoupdate.html">update_url</a>": "http://<em>path/to/updateInfo</em
>.xml", | |
| 60 "<a href="#web_accessible_resources">web_accessible_resources</a>": [...], | |
| 61 "<a href="#sandbox">sandbox</a>": [...] | |
| 62 } | 41 } |
| 63 </pre> | 42 </pre> |
| 64 | |
| 65 | |
| 66 <h2 id="field_details">Field details</h2> | |
| 67 | |
| 68 <p> | |
| 69 This section covers fields that aren't described in another page. | |
| 70 For a complete list of fields, | |
| 71 with links to where they're described in detail, | |
| 72 see the <a href="#overview">Field summary</a>. | |
| 73 </p> | |
| 74 | |
| 75 | |
| 76 <h3 id="app">app</h3> | |
| 77 | |
| 78 <p> | |
| 79 Used by <a href="../apps/app_lifecycle.html#eventpage">packaged apps</a> | |
| 80 to specify the app's background scripts. | |
| 81 Also used by <a href="https://developers.google.com/chrome/apps/docs/developers_
guide#live">hosted apps</a> | |
| 82 to specify the URLs that the app uses. | |
| 83 </p> | |
| 84 | |
| 85 <h3 id="default_locale">default_locale</h3> | |
| 86 | |
| 87 <p> | |
| 88 Specifies the subdirectory of <code>_locales</code> | |
| 89 that contains the default strings for this extension. | |
| 90 This field is <b>required</b> in extensions | |
| 91 that have a <code>_locales</code> directory; | |
| 92 it <b>must be absent</b> in extensions | |
| 93 that have no <code>_locales</code> directory. | |
| 94 For details, see | |
| 95 <a href="i18n.html">Internationalization</a>. | |
| 96 </p> | |
| 97 | |
| 98 <h3 id="description">description</h3> | |
| 99 | |
| 100 <p> | |
| 101 A plain text string | |
| 102 (no HTML or other formatting; | |
| 103 no more than 132 characters) | |
| 104 that describes the extension. | |
| 105 The description should be suitable for both | |
| 106 the browser's extension management UI | |
| 107 and the <a href="https://chrome.google.com/webstore">Chrome Web Store</a>. | |
| 108 You can specify locale-specific strings for this field; | |
| 109 see <a href="i18n.html">Internationalization</a> for details. | |
| 110 </p> | |
| 111 | |
| 112 <h3 id="file_handlers">file_handlers</h3> | |
| 113 | |
| 114 <p> | |
| 115 Used by <a href="../apps/app_lifecycle.html#eventpage">packaged apps</a> | |
| 116 to specify what types of files the app can handle. An app can have multiple <cod
e>file_handlers</code>, with each one having an identifier, a list of MIME types
that can be handled, and | |
| 117 a title. Here's an example of specifying file handlers: | |
| 118 </p> | |
| 119 | |
| 120 <pre> | |
| 121 "file_handlers": { | |
| 122 "text": { | |
| 123 "types": [ | |
| 124 "text/*" | |
| 125 ], | |
| 126 "title": "Text editor" | |
| 127 }, | |
| 128 "image": { | |
| 129 "types": [ | |
| 130 "image/png", | |
| 131 "image/jpeg" | |
| 132 ], | |
| 133 "title": "Image editor" | |
| 134 } | |
| 135 } | |
| 136 </pre> | |
| 137 | |
| 138 <p> | |
| 139 To handle files, apps also need to declare the $ref:fileSystem | |
| 140 permission. Apps can then be passed files in the $ref:app.runtime.onLaunched | |
| 141 event - either from the system | |
| 142 file manager (currently supported on ChromeOS only) or by providing | |
| 143 a path on the <a href="../apps/first_app.html#open">command line</a>. | |
| 144 </p> | |
| 145 | |
| 146 <h3 id="homepage_url">homepage_url</h3> | |
| 147 | |
| 148 <p> | |
| 149 The URL of the homepage for this extension. The extensions management page (chro
me://extensions) | |
| 150 will contain a link to this URL. This field is particularly useful if you | |
| 151 <a href="hosting.html">host the extension on your own site</a>. If you distribut
e your | |
| 152 extension using the <a href="https://chrome.google.com/webstore">Chrome Web Stor
e</a>, | |
| 153 the homepage URL defaults to the extension's own page. | |
| 154 </p> | |
| 155 | |
| 156 <h3 id="icons">icons</h3> | |
| 157 | |
| 158 <p> | |
| 159 One or more icons that represent the extension, app, or theme. | |
| 160 You should always provide a 128x128 icon; | |
| 161 it's used during installation and by the Chrome Web Store. | |
| 162 Extensions should also provide a 48x48 icon, | |
| 163 which is used in the extensions management page | |
| 164 (chrome://extensions). | |
| 165 You can also specify a 16x16 icon to be used as the favicon | |
| 166 for an extension's pages. | |
| 167 The 16x16 icon is also displayed in the experimental extension | |
| 168 <a href="experimental.infobars.html">infobar</a> | |
| 169 feature. | |
| 170 </p> | |
| 171 | |
| 172 <p> | |
| 173 Icons should generally be in PNG format, | |
| 174 because PNG has the best support for transparency. | |
| 175 They can, however, be in any format supported by WebKit, | |
| 176 including BMP, GIF, ICO, and JPEG. | |
| 177 Here's an example of specifying the icons: | |
| 178 </p> | |
| 179 | |
| 180 <pre> | |
| 181 "icons": { "16": "icon16.png", | |
| 182 "48": "icon48.png", | |
| 183 "128": "icon128.png" }, | |
| 184 </pre> | |
| 185 | |
| 186 <p class="note"> | |
| 187 You may provide icons of any other size you wish, and Chrome will attempt to use | |
| 188 the best size where appropriate. For example, Windows often requires 32-pixel | |
| 189 icons, and if the app includes a 32-pixel icon, Chrome will choose that instead | |
| 190 of shrinking a 48-pixel icon down. However, you should ensure that all of your | |
| 191 icons are square, or unexpected behavior may result. | |
| 192 </p> | |
| 193 | |
| 194 <p> | |
| 195 If you upload your extension, app, or theme using the | |
| 196 <a href="https://chrome.google.com/webstore/developer/dashboard">Chrome Develope
r Dashboard</a>, | |
| 197 you'll need to upload additional images, | |
| 198 including at least one screenshot of your extension. | |
| 199 For more information, | |
| 200 see the | |
| 201 <a href="http://code.google.com/chrome/webstore/">Chrome Web Store | |
| 202 developer documentation</a>. | |
| 203 </p> | |
| 204 | |
| 205 <h3 id="incognito">incognito</h3> | |
| 206 | |
| 207 <p> | |
| 208 Either "spanning" or "split", to specify how this extension will | |
| 209 behave if allowed to run in incognito mode. | |
| 210 </p> | |
| 211 | |
| 212 <p> | |
| 213 The default for extensions is "spanning", which means that the extension | |
| 214 will run in a single shared process. Any events or messages from an incognito | |
| 215 tab will be sent to the shared process, with an <em>incognito</em> flag | |
| 216 indicating where it came from. Because incognito tabs cannot use this shared | |
| 217 process, an extension using the "spanning" incognito mode will not be able to | |
| 218 load pages from its extension package into the main frame of an incognito tab. | |
| 219 </p> | |
| 220 | |
| 221 <p> | |
| 222 The default for installable web apps is "split", | |
| 223 which means that all app pages in | |
| 224 an incognito window will run in their own incognito process. If the app or exten
sion contains a background page, that will also run in the incognito process. | |
| 225 This incognito process runs along side the regular process, but has a separate | |
| 226 memory-only cookie store. Each process sees events and messages only from its | |
| 227 own context (for example, the incognito process will see only incognito tab upda
tes). | |
| 228 The processes are unable to communicate with each other. | |
| 229 </p> | |
| 230 | |
| 231 <p> | |
| 232 As a rule of thumb, if your extension or app needs to load a tab in an incognito
browser, use | |
| 233 <em>split</em> incognito behavior. If your extension or app needs to be logged | |
| 234 into a remote server or persist settings locally, use <em>spanning</em> | |
| 235 incognito behavior. | |
| 236 </p> | |
| 237 | |
| 238 <h3 id="key">key</h3> | |
| 239 | |
| 240 <p> | |
| 241 This value can be used to control | |
| 242 the unique ID of an extension, app, or theme when | |
| 243 it is loaded during development. | |
| 244 </p> | |
| 245 | |
| 246 <p class="note"> | |
| 247 <b>Note:</b> You don't usually need to | |
| 248 use this value. Instead, write your | |
| 249 code so that the key value doesn't matter | |
| 250 by using <a href="overview.html#relative-urls">relative paths</a> | |
| 251 and $ref:runtime.getURL. | |
| 252 </p> | |
| 253 | |
| 254 <p> | |
| 255 To get a suitable key value, first | |
| 256 install your extension from a <code>.crx</code> file | |
| 257 (you may need to | |
| 258 <a href="https://chrome.google.com/webstore/developer/dashboard">upload your ext
ension</a> | |
| 259 or <a href="packaging.html">package it manually</a>). | |
| 260 Then, in your | |
| 261 <a href="http://www.chromium.org/user-experience/user-data-directory">user | |
| 262 data directory</a>, look in the file | |
| 263 <code>Default/Extensions/<em><extensionId></em>/<em><versionString><
/em>/manifest.json</code>. | |
| 264 You will see the key value filled in there. | |
| 265 </p> | |
| 266 | |
| 267 <h3 id="minimum_chrome_version">minimum_chrome_version</h3> | |
| 268 | |
| 269 <p> | |
| 270 The version of Chrome that your extension, app, or theme requires, if any. | |
| 271 The format for this string is the same as for the | |
| 272 <a href="#version">version</a> field. | |
| 273 | |
| 274 <h3 id="name">name</h3> | |
| 275 | |
| 276 <p> | |
| 277 A short, plain text string | |
| 278 (no more than 45 characters) | |
| 279 that identifies the extension. | |
| 280 The name is used in the install dialog, | |
| 281 extension management UI, | |
| 282 and the <a href="https://chrome.google.com/webstore">store</a>. | |
| 283 You can specify locale-specific strings for this field; | |
| 284 see <a href="i18n.html">Internationalization</a> for details. | |
| 285 </p> | |
| 286 | |
| 287 <h3 id="nacl_modules">nacl_modules</h3> | |
| 288 | |
| 289 <p> | |
| 290 One or more mappings from MIME types to the Native Client module | |
| 291 that handles each type. | |
| 292 For example, the bold code in the following snippet | |
| 293 registers a Native Client module as the content handler | |
| 294 for the OpenOffice spreadsheet MIME type. | |
| 295 </p> | |
| 296 | |
| 297 <pre> | |
| 298 { | |
| 299 "name": "Native Client OpenOffice Spreadsheet Viewer", | |
| 300 "version": "0.1", | |
| 301 "description": "Open OpenOffice spreadsheets, right in your browser.", | |
| 302 <b>"nacl_modules": [{ | |
| 303 "path": "OpenOfficeViewer.nmf", | |
| 304 "mime_type": "application/vnd.oasis.opendocument.spreadsheet" | |
| 305 }]</b> | |
| 306 } | |
| 307 </pre> | |
| 308 | |
| 309 <p> | |
| 310 The value of "path" is the location of a Native Client manifest | |
| 311 (a <code>.nmf</code> file) | |
| 312 within the extension directory. | |
| 313 For more information on Native Client and <code>.nmf</code> files, see the | |
| 314 <a href="http://code.google.com/chrome/nativeclient/docs/technical_overview.html
">Native Client Technical Overview</a>. | |
| 315 </p> | |
| 316 | |
| 317 <p> | |
| 318 Each MIME type can be associated with only one <code>.nmf</code> file, | |
| 319 but a single <code>.nmf</code> file might handle multiple MIME types. | |
| 320 The following example shows an extension | |
| 321 with two <code>.nmf</code> files | |
| 322 that handle three MIME types. | |
| 323 </p> | |
| 324 | |
| 325 <pre> | |
| 326 { | |
| 327 "name": "Spreadsheet Viewer", | |
| 328 "version": "0.1", | |
| 329 "description": "Open OpenOffice and Excel spreadsheets, right in your browser.
", | |
| 330 "nacl_modules": [{ | |
| 331 "path": "OpenOfficeViewer.nmf", | |
| 332 "mime_type": "application/vnd.oasis.opendocument.spreadsheet" | |
| 333 }, | |
| 334 { | |
| 335 "path": "OpenOfficeViewer.nmf", | |
| 336 "mime_type": "application/vnd.oasis.opendocument.spreadsheet-template" | |
| 337 }, | |
| 338 { | |
| 339 "path": "ExcelViewer.nmf", | |
| 340 "mime_type": "application/excel" | |
| 341 }] | |
| 342 } | |
| 343 </pre> | |
| 344 | |
| 345 <p class="note"> | |
| 346 <strong>Note:</strong> | |
| 347 You can use Native Client modules in extensions | |
| 348 without specifying "nacl_modules". | |
| 349 Use "nacl_modules" only if you want the browser | |
| 350 to use your Native Client module | |
| 351 to display a particular type of content. | |
| 352 </p> | |
| 353 | |
| 354 <h3 id="kiosk_enabled">kiosk_enabled</h3> | |
| 355 | |
| 356 <p> | |
| 357 Whether the packaged app is designed to expected to work in ChromeOS kiosk mode. | |
| 358 In kiosk mode, the platform app window will cover the entire surface of the | |
| 359 display (forced full screen). The kiosk-enabled apps are expected to be designed | |
| 360 with this constraint in mind. | |
| 361 </p> | |
| 362 | |
| 363 <h3 id="offline_enabled">offline_enabled</h3> | |
| 364 | |
| 365 <p> | |
| 366 Whether the app or extension is expected to work offline. When Chrome detects | |
| 367 that it is offline, apps with this field set to true will be highlighted | |
| 368 on the New Tab page. | |
| 369 </p> | |
| 370 | |
| 371 <h3 id="requirements">requirements</h3> | |
| 372 | |
| 373 <p> | |
| 374 Technologies required by the app or extension. | |
| 375 Hosting sites such as the Chrome Web Store may use this list | |
| 376 to dissuade users from installing apps or extensions | |
| 377 that will not work on their computer. | |
| 378 Supported requirements currently include "3D" and "plugins"; | |
| 379 additional requirements checks may be added in the future. | |
| 380 </p> | |
| 381 | |
| 382 <p> | |
| 383 The "3D" requirement denotes GPU hardware acceleration. | |
| 384 The "webgl" requirement refers to the | |
| 385 <a href="http://www.khronos.org/webgl/">WebGL API</a>. | |
| 386 For more information on Chrome 3D graphics support, | |
| 387 see the help article on | |
| 388 <a href="http://www.google.com/support/chrome/bin/answer.py?answer=1220892">WebG
L and 3D graphics</a>. | |
| 389 You can list the 3D-related features your app requires, | |
| 390 as demonstrated in the following example: | |
| 391 </p> | |
| 392 | |
| 393 <pre> | |
| 394 "requirements": { | |
| 395 "3D": { | |
| 396 "features": ["webgl"] | |
| 397 } | |
| 398 } | |
| 399 </pre> | |
| 400 | |
| 401 <p> | |
| 402 The "plugins" requirement indicates | |
| 403 if an app or extension requires NPAPI to run. | |
| 404 This requirement is enabled by default | |
| 405 when the manifest includes the | |
| 406 <a href="http://developer.chrome.com/extensions/npapi.html">"plugins" field</a>.
| |
| 407 For apps and extensions that still work when plugins aren't available, | |
| 408 you can disable this requirement | |
| 409 by setting NPAPI to false. | |
| 410 You can also enable this requirement manually, | |
| 411 by setting NPAPI to true, | |
| 412 as shown in this example: | |
| 413 </p> | |
| 414 | |
| 415 <pre> | |
| 416 "requirements": { | |
| 417 "plugins": { | |
| 418 "npapi": true | |
| 419 } | |
| 420 } | |
| 421 </pre> | |
| 422 | |
| 423 | |
| 424 <h3 id="version">version</h3> | |
| 425 | |
| 426 <p> | |
| 427 One to four dot-separated integers | |
| 428 identifying the version of this extension. | |
| 429 A couple of rules apply to the integers: | |
| 430 they must be between 0 and 65535, inclusive, | |
| 431 and non-zero integers can't start with 0. | |
| 432 For example, 99999 and 032 are both invalid. | |
| 433 </p> | |
| 434 | |
| 435 <p> | |
| 436 Here are some examples of valid versions: | |
| 437 </p> | |
| 438 | |
| 439 <ul> | |
| 440 <li> <code>"version": "1"</code> </li> | |
| 441 <li> <code>"version": "1.0"</code> </li> | |
| 442 <li> <code>"version": "2.10.2"</code> </li> | |
| 443 <li> <code>"version": "3.1.2.4567"</code> </li> | |
| 444 </ul> | |
| 445 | |
| 446 <p> | |
| 447 The autoupdate system compares versions | |
| 448 to determine whether an installed extension | |
| 449 needs to be updated. | |
| 450 If the published extension has a newer version string | |
| 451 than the installed extension, | |
| 452 then the extension is automatically updated. | |
| 453 </p> | |
| 454 | |
| 455 <p> | |
| 456 The comparison starts with the leftmost integers. | |
| 457 If those integers are equal, | |
| 458 the integers to the right are compared, | |
| 459 and so on. | |
| 460 For example, 1.2.0 is a newer version than 1.1.9.9999. | |
| 461 </p> | |
| 462 | |
| 463 <p> | |
| 464 A missing integer is equal to zero. | |
| 465 For example, 1.1.9.9999 is newer than 1.1. | |
| 466 </p> | |
| 467 | |
| 468 <p> | |
| 469 For more information, see | |
| 470 <a href="autoupdate.html">Autoupdating</a>. | |
| 471 </p> | |
| 472 | |
| 473 | |
| 474 | |
| 475 <h3 id="manifest_version">manifest_version</h3> | |
| 476 | |
| 477 <p> | |
| 478 One integer specifying the version of the manifest file format your package | |
| 479 requires. As of Chrome 18, developers <em>should</em> specify <code>2</code> | |
| 480 (without quotes) to use the format as described by this document: | |
| 481 </p> | |
| 482 | |
| 483 <pre>"manifest_version": 2</pre> | |
| 484 | |
| 485 <p> | |
| 486 Consider manifest version 1 <em>deprecated</em> as of Chrome 18. Version 2 is | |
| 487 not yet <em>required</em>, but we will, at some point in the not-too-distant | |
| 488 future, stop supporting packages using deprecated manifest versions. Extensions, | |
| 489 applications, and themes that aren't ready to make the jump to the new manifest | |
| 490 version in Chrome 18 can either explicitly specify version <code>1</code>, or | |
| 491 leave the key off entirely. | |
| 492 </p> | |
| 493 | |
| 494 <p> | |
| 495 The changes between version 1 and version 2 of the manifest file format are | |
| 496 described in detail in <a href="manifestVersion.html">the | |
| 497 <code>manifest_version</code> documentation.</a> | |
| 498 </p> | |
| 499 | |
| 500 <p class="caution"> | |
| 501 Setting <code>manifest_version</code> 2 in Chrome 17 or lower is not | |
| 502 recommended. If your extension needs to work in older versions of Chrome, | |
| 503 stick with version 1 for the moment. We'll give you ample warning before | |
| 504 version 1 stops working. | |
| 505 </p> | |
| 506 | |
| 507 <h3 id="web_accessible_resources">web_accessible_resources</h3> | |
| 508 | |
| 509 <p> | |
| 510 An array of strings specifying the paths (relative to the package root) of | |
| 511 packaged resources that are expected to be usable in the context of a web page. | |
| 512 For example, an extension that injects a content script with the intention of | |
| 513 building up some custom interface for <code>example.com</code> would whitelist | |
| 514 any resources that interface requires (images, icons, stylesheets, scripts, | |
| 515 etc.) as follows: | |
| 516 </p> | |
| 517 | |
| 518 <pre>{ | |
| 519 ... | |
| 520 "web_accessible_resources": [ | |
| 521 "images/my-awesome-image1.png", | |
| 522 "images/my-amazing-icon1.png", | |
| 523 "style/double-rainbow.css", | |
| 524 "script/double-rainbow.js" | |
| 525 ], | |
| 526 ... | |
| 527 }</pre> | |
| 528 | |
| 529 <p> | |
| 530 These resources would then be available in a webpage via the URL | |
| 531 <code>chrome-extension://[PACKAGE ID]/[PATH]</code>, which can be generated with | |
| 532 the $ref:runtime.getURL method. Whitelisted resources are served with appropriat
e | |
| 533 <a href="http://www.w3.org/TR/cors/">CORS</a> headers, so they're available via | |
| 534 mechanisms like XHR. | |
| 535 </p> | |
| 536 | |
| 537 <p> | |
| 538 Injected content scripts themselves do not need to be whitelisted. | |
| 539 </p> | |
| 540 | |
| 541 <p> | |
| 542 Prior to manifest version 2 all resources within an extension could be accessed | |
| 543 from any page on the web. This allowed a malicious website to | |
| 544 <a href="http://en.wikipedia.org/wiki/Device_fingerprint">fingerprint</a> the | |
| 545 extensions that a user has installed or exploit vulnerabilities (for example | |
| 546 <a href="http://en.wikipedia.org/wiki/Cross-site_scripting">XSS bugs</a>)within | |
| 547 installed extensions. Limiting availability to only resources which are | |
| 548 explicitly intended to be web accessible serves to both minimize the available | |
| 549 attack surface and protect the privacy of users. | |
| 550 </p> | |
| 551 | |
| 552 <h4 id="availability">Default Availability</h4> | |
| 553 | |
| 554 <p> | |
| 555 Resources inside of packages using <a href="#manifest_version"><code>manifest_ve
rsion</code></a> | |
| 556 2 or above are <strong>blocked by default</strong>, and must be whitelisted | |
| 557 for use via this property. | |
| 558 </p> | |
| 559 | |
| 560 <p> | |
| 561 Resources inside of packages using <code>manifest_version</code> 1 are available | |
| 562 by default, but <em>if</em> you do set this property, then it will be treated as | |
| 563 a complete list of all whitelisted resources. Resources not listed will be | |
| 564 blocked. | |
| 565 </p> | |
| 566 | |
| 567 <h3 id="sandbox">sandbox</h3> | |
| 568 | |
| 569 <p> | |
| 570 Defines an collection of app or extension pages that are to be served | |
| 571 in a sandboxed unique origin, and optionally a Content Security Policy to use | |
| 572 with them. Being in a sandbox has two implications: | |
| 573 </p> | |
| 574 | |
| 575 <ol> | |
| 576 <li>A sandboxed page will not have access to extension or app APIs, or | |
| 577 direct access to non-sandboxed pages (it may communicate with them via | |
| 578 <code>postMessage()</code>).</li> | |
| 579 <li> | |
| 580 <p>A sandboxed page is not subject to the | |
| 581 <a href="../extensions/contentSecurityPolicy.html">Content Security Policy | |
| 582 (CSP)</a> used by the rest of the app or extension (it has its own separate | |
| 583 CSP value). This means that, for example, it can use inline script and | |
| 584 <code>eval</code>.</p> | |
| 585 | |
| 586 <p>For example, here's how to specify that two extension pages are to be | |
| 587 served in a sandbox with a custom CSP:</p> | |
| 588 | |
| 589 <pre>{ | |
| 590 ... | |
| 591 "sandbox": { | |
| 592 "pages": [ | |
| 593 "page1.html", | |
| 594 "directory/page2.html" | |
| 595 ] | |
| 596 <i>// content_security_policy is optional.</i> | |
| 597 "content_security_policy": | |
| 598 "sandbox allow-scripts; script-src https://www.google.com" | |
| 599 ], | |
| 600 ... | |
| 601 }</pre> | |
| 602 | |
| 603 <p> | |
| 604 If not specified, the default <code>content_security_policy</code> value is | |
| 605 <code>sandbox allow-scripts allow-forms</code>. You can specify your CSP | |
| 606 value to restrict the sandbox even further, but it must have the <code>sandbox
</code> | |
| 607 directive and may not have the <code>allow-same-origin</code> token (see | |
| 608 <a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/the-ifram
e-element.html#attr-iframe-sandbox">the | |
| 609 HTML5 specification</a> for possible sandbox tokens). | |
| 610 </p> | |
| 611 </li> | |
| 612 </ol> | |
| 613 | |
| 614 <p> | |
| 615 Note that you only need to list pages that you expected to be loaded in | |
| 616 windows or frames. Resources used by sandboxed pages (e.g. stylesheets or | |
| 617 JavaScript source files) do not need to appear in the | |
| 618 <code>sandboxed_page</code> list, they will use the sandbox of the page | |
| 619 that embeds them. | |
| 620 </p> | |
| 621 | |
| 622 <p> | |
| 623 <a href="sandboxingEval.html">"Using eval in Chrome Extensions. Safely."</a> | |
| 624 goes into more detail about implementing a sandboxing workflow that enables use | |
| 625 of libraries that would otherwise have issues executing under extension's | |
| 626 <a href="../extensions/contentSecurityPolicy.html">default Content Security | |
| 627 Policy</a>. | |
| 628 </p> | |
| 629 | |
| 630 <p> | |
| 631 Sandboxed page may only be specified when using | |
| 632 <a href="#manifest_version"><code>manifest_version</code></a> 2 or above. | |
| 633 </p> | |
| OLD | NEW |