| OLD | NEW |
| 1 <h1 id="sandbox">Manifest - Sandbox</h1> | 1 <h1 id="sandbox">Manifest - Sandbox</h1> |
| 2 | 2 |
| 3 <p> | 3 <p> |
| 4 Defines an collection of app or extension pages that are to be served | 4 Defines an collection of app or extension pages that are to be served |
| 5 in a sandboxed unique origin, and optionally a Content Security Policy to use | 5 in a sandboxed unique origin, and optionally a Content Security Policy to use |
| 6 with them. Being in a sandbox has two implications: | 6 with them. Being in a sandbox has two implications: |
| 7 </p> | 7 </p> |
| 8 | 8 |
| 9 <ol> | 9 <ol> |
| 10 <li>A sandboxed page will not have access to extension or app APIs, or | 10 <li>A sandboxed page will not have access to extension or app APIs, or |
| 11 direct access to non-sandboxed pages (it may communicate with them via | 11 direct access to non-sandboxed pages (it may communicate with them via |
| 12 <code>postMessage()</code>).</li> | 12 <code>postMessage()</code>).</li> |
| 13 <li> | 13 <li> |
| 14 <p>A sandboxed page is not subject to the | 14 <p>A sandboxed page is not subject to the |
| 15 <a href="http://developer.chrome.com/extensions/contentSecurityPolicy.html">Co
ntent Security Policy | 15 <a href="http://developer.chrome.com/extensions/contentSecurityPolicy">Content
Security Policy |
| 16 (CSP)</a> used by the rest of the app or extension (it has its own separate | 16 (CSP)</a> used by the rest of the app or extension (it has its own separate |
| 17 CSP value). This means that, for example, it can use inline script and | 17 CSP value). This means that, for example, it can use inline script and |
| 18 <code>eval</code>.</p> | 18 <code>eval</code>.</p> |
| 19 | 19 |
| 20 <p>For example, here's how to specify that two extension pages are to be | 20 <p>For example, here's how to specify that two extension pages are to be |
| 21 served in a sandbox with a custom CSP:</p> | 21 served in a sandbox with a custom CSP:</p> |
| 22 | 22 |
| 23 <pre data-filename="manifest.json"> | 23 <pre data-filename="manifest.json"> |
| 24 { | 24 { |
| 25 ... | 25 ... |
| (...skipping 23 matching lines...) Expand all Loading... |
| 49 | 49 |
| 50 <p> | 50 <p> |
| 51 Note that you only need to list pages that you expected to be loaded in | 51 Note that you only need to list pages that you expected to be loaded in |
| 52 windows or frames. Resources used by sandboxed pages (e.g. stylesheets or | 52 windows or frames. Resources used by sandboxed pages (e.g. stylesheets or |
| 53 JavaScript source files) do not need to appear in the | 53 JavaScript source files) do not need to appear in the |
| 54 <code>sandboxed_page</code> list, they will use the sandbox of the page | 54 <code>sandboxed_page</code> list, they will use the sandbox of the page |
| 55 that embeds them. | 55 that embeds them. |
| 56 </p> | 56 </p> |
| 57 | 57 |
| 58 <p> | 58 <p> |
| 59 <a href="http://developer.chrome.com/extensions/sandboxingEval.html">"Using eval
in Chrome Extensions. Safely."</a> | 59 <a href="http://developer.chrome.com/extensions/sandboxingEval">"Using eval in C
hrome Extensions. Safely."</a> |
| 60 goes into more detail about implementing a sandboxing workflow that enables use | 60 goes into more detail about implementing a sandboxing workflow that enables use |
| 61 of libraries that would otherwise have issues executing under extension's | 61 of libraries that would otherwise have issues executing under extension's |
| 62 <a href="http://developer.chrome.com/extensions/contentSecurityPolicy.html">defa
ult Content Security | 62 <a href="http://developer.chrome.com/extensions/contentSecurityPolicy">default C
ontent Security |
| 63 Policy</a>. | 63 Policy</a>. |
| 64 </p> | 64 </p> |
| 65 | 65 |
| 66 <p> | 66 <p> |
| 67 Sandboxed page may only be specified when using | 67 Sandboxed page may only be specified when using |
| 68 <a href="http://developer.chrome.com/extensions/manifest.html#manifest_version">
<code>manifest_version</code></a> 2 or above. | 68 <a href="http://developer.chrome.com/extensions/manifest#manifest_version"><code
>manifest_version</code></a> 2 or above. |
| 69 </p> | 69 </p> |
| OLD | NEW |