OLD | NEW |
1 <h1 id="sandbox">Manifest - Sandbox</h1> | 1 <h1 id="sandbox">Manifest - Sandbox</h1> |
2 | 2 |
3 <p> | 3 <p> |
4 Defines an collection of app or extension pages that are to be served | 4 Defines an collection of app or extension pages that are to be served |
5 in a sandboxed unique origin, and optionally a Content Security Policy to use | 5 in a sandboxed unique origin, and optionally a Content Security Policy to use |
6 with them. Being in a sandbox has two implications: | 6 with them. Being in a sandbox has two implications: |
7 </p> | 7 </p> |
8 | 8 |
9 <ol> | 9 <ol> |
10 <li>A sandboxed page will not have access to extension or app APIs, or | 10 <li>A sandboxed page will not have access to extension or app APIs, or |
11 direct access to non-sandboxed pages (it may communicate with them via | 11 direct access to non-sandboxed pages (it may communicate with them via |
12 <code>postMessage()</code>).</li> | 12 <code>postMessage()</code>).</li> |
13 <li> | 13 <li> |
14 <p>A sandboxed page is not subject to the | 14 <p>A sandboxed page is not subject to the |
15 <a href="http://developer.chrome.com/extensions/contentSecurityPolicy.html">Co
ntent Security Policy | 15 <a href="http://developer.chrome.com/extensions/contentSecurityPolicy">Content
Security Policy |
16 (CSP)</a> used by the rest of the app or extension (it has its own separate | 16 (CSP)</a> used by the rest of the app or extension (it has its own separate |
17 CSP value). This means that, for example, it can use inline script and | 17 CSP value). This means that, for example, it can use inline script and |
18 <code>eval</code>.</p> | 18 <code>eval</code>.</p> |
19 | 19 |
20 <p>For example, here's how to specify that two extension pages are to be | 20 <p>For example, here's how to specify that two extension pages are to be |
21 served in a sandbox with a custom CSP:</p> | 21 served in a sandbox with a custom CSP:</p> |
22 | 22 |
23 <pre data-filename="manifest.json"> | 23 <pre data-filename="manifest.json"> |
24 { | 24 { |
25 ... | 25 ... |
(...skipping 23 matching lines...) Expand all Loading... |
49 | 49 |
50 <p> | 50 <p> |
51 Note that you only need to list pages that you expected to be loaded in | 51 Note that you only need to list pages that you expected to be loaded in |
52 windows or frames. Resources used by sandboxed pages (e.g. stylesheets or | 52 windows or frames. Resources used by sandboxed pages (e.g. stylesheets or |
53 JavaScript source files) do not need to appear in the | 53 JavaScript source files) do not need to appear in the |
54 <code>sandboxed_page</code> list, they will use the sandbox of the page | 54 <code>sandboxed_page</code> list, they will use the sandbox of the page |
55 that embeds them. | 55 that embeds them. |
56 </p> | 56 </p> |
57 | 57 |
58 <p> | 58 <p> |
59 <a href="http://developer.chrome.com/extensions/sandboxingEval.html">"Using eval
in Chrome Extensions. Safely."</a> | 59 <a href="http://developer.chrome.com/extensions/sandboxingEval">"Using eval in C
hrome Extensions. Safely."</a> |
60 goes into more detail about implementing a sandboxing workflow that enables use | 60 goes into more detail about implementing a sandboxing workflow that enables use |
61 of libraries that would otherwise have issues executing under extension's | 61 of libraries that would otherwise have issues executing under extension's |
62 <a href="http://developer.chrome.com/extensions/contentSecurityPolicy.html">defa
ult Content Security | 62 <a href="http://developer.chrome.com/extensions/contentSecurityPolicy">default C
ontent Security |
63 Policy</a>. | 63 Policy</a>. |
64 </p> | 64 </p> |
65 | 65 |
66 <p> | 66 <p> |
67 Sandboxed page may only be specified when using | 67 Sandboxed page may only be specified when using |
68 <a href="http://developer.chrome.com/extensions/manifest.html#manifest_version">
<code>manifest_version</code></a> 2 or above. | 68 <a href="http://developer.chrome.com/extensions/manifest#manifest_version"><code
>manifest_version</code></a> 2 or above. |
69 </p> | 69 </p> |
OLD | NEW |