OLD | NEW |
1 <h1>Embed Content</h1> | 1 <h1>Embed Content</h1> |
2 | 2 |
3 | 3 |
4 <p> | 4 <p> |
5 The <a href="app_architecture.html#security">packaged apps security model</a> di
sallows | 5 The <a href="app_architecture.html#security">packaged apps security model</a> di
sallows |
6 external content in iframes and | 6 external content in iframes and |
7 the use of inline scripting and <code>eval()</code>. | 7 the use of inline scripting and <code>eval()</code>. |
8 You can override these restrictions, | 8 You can override these restrictions, |
9 but your external content must be isolated from the app. | 9 but your external content must be isolated from the app. |
10 </p> | 10 </p> |
(...skipping 107 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
118 | 118 |
119 <h2 id="sandboxing">Sandbox local content</h2> | 119 <h2 id="sandboxing">Sandbox local content</h2> |
120 | 120 |
121 <p> | 121 <p> |
122 Sandboxing allows specified pages | 122 Sandboxing allows specified pages |
123 to be served in a sandboxed, unique origin. | 123 to be served in a sandboxed, unique origin. |
124 These pages are then exempt from their Content Security Policy. | 124 These pages are then exempt from their Content Security Policy. |
125 Sandboxed pages can use iframes, inline scripting, | 125 Sandboxed pages can use iframes, inline scripting, |
126 and <code>eval()</code>. | 126 and <code>eval()</code>. |
127 Check out the manifest field description for | 127 Check out the manifest field description for |
128 <a href="manifest.html#sandbox">sandbox</a>. | 128 <a href="manifest/sandbox.html">sandbox</a>. |
129 </p> | 129 </p> |
130 | 130 |
131 <p> | 131 <p> |
132 It's a trade-off though: | 132 It's a trade-off though: |
133 sandboxed pages can't use the chrome.* APIs. | 133 sandboxed pages can't use the chrome.* APIs. |
134 If you need to do things like <code>eval()</code>, | 134 If you need to do things like <code>eval()</code>, |
135 go this route to be exempt from CSP, | 135 go this route to be exempt from CSP, |
136 but you won't be able to use the cool new stuff. | 136 but you won't be able to use the cool new stuff. |
137 </p> | 137 </p> |
138 | 138 |
(...skipping 139 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
278 | 278 |
279 <pre> | 279 <pre> |
280 var messageHandler = function(e) { | 280 var messageHandler = function(e) { |
281 console.log('Background script says hello.', e.data); | 281 console.log('Background script says hello.', e.data); |
282 }; | 282 }; |
283 | 283 |
284 window.addEventListener('message', messageHandler); | 284 window.addEventListener('message', messageHandler); |
285 </pre> | 285 </pre> |
286 | 286 |
287 <p class="backtotop"><a href="#top">Back to top</a></p> | 287 <p class="backtotop"><a href="#top">Back to top</a></p> |
OLD | NEW |