| OLD | NEW |
| 1 <h1>Embed Content</h1> | 1 <h1>Embed Content</h1> |
| 2 | 2 |
| 3 | 3 |
| 4 <p> | 4 <p> |
| 5 The <a href="app_architecture.html#security">packaged apps security model</a> di
sallows | 5 The <a href="app_architecture.html#security">packaged apps security model</a> di
sallows |
| 6 external content in iframes and | 6 external content in iframes and |
| 7 the use of inline scripting and <code>eval()</code>. | 7 the use of inline scripting and <code>eval()</code>. |
| 8 You can override these restrictions, | 8 You can override these restrictions, |
| 9 but your external content must be isolated from the app. | 9 but your external content must be isolated from the app. |
| 10 </p> | 10 </p> |
| (...skipping 107 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 118 | 118 |
| 119 <h2 id="sandboxing">Sandbox local content</h2> | 119 <h2 id="sandboxing">Sandbox local content</h2> |
| 120 | 120 |
| 121 <p> | 121 <p> |
| 122 Sandboxing allows specified pages | 122 Sandboxing allows specified pages |
| 123 to be served in a sandboxed, unique origin. | 123 to be served in a sandboxed, unique origin. |
| 124 These pages are then exempt from their Content Security Policy. | 124 These pages are then exempt from their Content Security Policy. |
| 125 Sandboxed pages can use iframes, inline scripting, | 125 Sandboxed pages can use iframes, inline scripting, |
| 126 and <code>eval()</code>. | 126 and <code>eval()</code>. |
| 127 Check out the manifest field description for | 127 Check out the manifest field description for |
| 128 <a href="manifest.html#sandbox">sandbox</a>. | 128 <a href="manifest/sandbox.html">sandbox</a>. |
| 129 </p> | 129 </p> |
| 130 | 130 |
| 131 <p> | 131 <p> |
| 132 It's a trade-off though: | 132 It's a trade-off though: |
| 133 sandboxed pages can't use the chrome.* APIs. | 133 sandboxed pages can't use the chrome.* APIs. |
| 134 If you need to do things like <code>eval()</code>, | 134 If you need to do things like <code>eval()</code>, |
| 135 go this route to be exempt from CSP, | 135 go this route to be exempt from CSP, |
| 136 but you won't be able to use the cool new stuff. | 136 but you won't be able to use the cool new stuff. |
| 137 </p> | 137 </p> |
| 138 | 138 |
| (...skipping 139 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 278 | 278 |
| 279 <pre> | 279 <pre> |
| 280 var messageHandler = function(e) { | 280 var messageHandler = function(e) { |
| 281 console.log('Background script says hello.', e.data); | 281 console.log('Background script says hello.', e.data); |
| 282 }; | 282 }; |
| 283 | 283 |
| 284 window.addEventListener('message', messageHandler); | 284 window.addEventListener('message', messageHandler); |
| 285 </pre> | 285 </pre> |
| 286 | 286 |
| 287 <p class="backtotop"><a href="#top">Back to top</a></p> | 287 <p class="backtotop"><a href="#top">Back to top</a></p> |
| OLD | NEW |