Index: trunk/src/chrome/common/extensions/docs/templates/articles/manifest/sandbox.html |
=================================================================== |
--- trunk/src/chrome/common/extensions/docs/templates/articles/manifest/sandbox.html (revision 199633) |
+++ trunk/src/chrome/common/extensions/docs/templates/articles/manifest/sandbox.html (working copy) |
@@ -1,67 +0,0 @@ |
-<h1 id="sandbox">Manifest - Sandbox</h1> |
- |
-<p> |
-Defines an collection of app or extension pages that are to be served |
-in a sandboxed unique origin, and optionally a Content Security Policy to use |
-with them. Being in a sandbox has two implications: |
-</p> |
- |
-<ol> |
-<li>A sandboxed page will not have access to extension or app APIs, or |
-direct access to non-sandboxed pages (it may communicate with them via |
-<code>postMessage()</code>).</li> |
-<li> |
- <p>A sandboxed page is not subject to the |
- <a href="http://developer.chrome.com/extensions/contentSecurityPolicy.html">Content Security Policy |
- (CSP)</a> used by the rest of the app or extension (it has its own separate |
- CSP value). This means that, for example, it can use inline script and |
- <code>eval</code>.</p> |
- |
- <p>For example, here's how to specify that two extension pages are to be |
- served in a sandbox with a custom CSP:</p> |
- |
- <pre class="prettyprint"><span class="pun">{</span><span class="pln"> |
- </span><span class="pun">...</span><span class="pln"> |
- </span><span class="str">"sandbox"</span><span class="pun">:</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> |
- </span><span class="str">"pages"</span><span class="pun">:</span><span class="pln"> </span><span class="pun">[</span><span class="pln"> |
- </span><span class="str">"page1.html"</span><span class="pun">,</span><span class="pln"> |
- </span><span class="str">"directory/page2.html"</span><span class="pln"> |
- </span><span class="pun">]</span><span class="pln"> |
- </span><i><span class="com">// content_security_policy is optional.</span></i><span class="pln"> |
- </span><span class="str">"content_security_policy"</span><span class="pun">:</span><span class="pln"> |
- </span><span class="str">"sandbox allow-scripts; script-src https://www.google.com"</span><span class="pln"> |
- </span><span class="pun">],</span><span class="pln"> |
- </span><span class="pun">...</span><span class="pln"> |
-</span><span class="pun">}</span></pre> |
- |
- <p> |
- If not specified, the default <code>content_security_policy</code> value is |
- <code>sandbox allow-scripts allow-forms</code>. You can specify your CSP |
- value to restrict the sandbox even further, but it must have the <code>sandbox</code> |
- directive and may not have the <code>allow-same-origin</code> token (see |
- <a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html#attr-iframe-sandbox">the |
- HTML5 specification</a> for possible sandbox tokens). |
- </p> |
-</li> |
-</ol> |
- |
-<p> |
-Note that you only need to list pages that you expected to be loaded in |
-windows or frames. Resources used by sandboxed pages (e.g. stylesheets or |
-JavaScript source files) do not need to appear in the |
-<code>sandboxed_page</code> list, they will use the sandbox of the page |
-that embeds them. |
-</p> |
- |
-<p> |
-<a href="http://developer.chrome.com/extensions/sandboxingEval.html">"Using eval in Chrome Extensions. Safely."</a> |
-goes into more detail about implementing a sandboxing workflow that enables use |
-of libraries that would otherwise have issues executing under extension's |
-<a href="http://developer.chrome.com/extensions/contentSecurityPolicy.html">default Content Security |
-Policy</a>. |
-</p> |
- |
-<p> |
-Sandboxed page may only be specified when using |
-<a href="http://developer.chrome.com/extensions/manifest.html#manifest_version"><code>manifest_version</code></a> 2 or above. |
-</p> |