| Index: chrome/common/extensions/docs/templates/articles/sandboxingEval.html
|
| diff --git a/chrome/common/extensions/docs/templates/articles/sandboxingEval.html b/chrome/common/extensions/docs/templates/articles/sandboxingEval.html
|
| index d8746d1e6ab9a2efa6250941741b5666cd9a5ae3..bdb91c0c795f62ee8ed73fd14cacb4fa9e3358df 100644
|
| --- a/chrome/common/extensions/docs/templates/articles/sandboxingEval.html
|
| +++ b/chrome/common/extensions/docs/templates/articles/sandboxingEval.html
|
| @@ -3,13 +3,13 @@
|
|
|
| <p>
|
| Chrome's extension system enforces a fairly strict default
|
| - <a href='../extensions/contentSecurityPolicy.html'>
|
| + <a href='../extensions/contentSecurityPolicy'>
|
| <strong>Content Security Policy (CSP)</strong>
|
| </a>. The policy restrictions are straightforward: script must be moved
|
| out-of-line into separate JavaScript files, inline event handlers must be
|
| converted to use <code>addEventListener</code>, and <code>eval()</code> is
|
| disabled. Chrome Apps have an
|
| - <a href='contentSecurityPolicy.html'>even more strict
|
| + <a href='contentSecurityPolicy'>even more strict
|
| policy</a>, and we're quite happy with the security properties these policies
|
| provide.
|
| </p>
|
| @@ -60,7 +60,7 @@
|
|
|
| <p>
|
| If you'd like to dive straight into code, please grab the
|
| - <a href='/extensions/samples.html#sandboxed-frame'>sandboxing
|
| + <a href='/extensions/samples#sandboxed-frame'>sandboxing
|
| sample extension and take off</a>. It's a working example of a tiny messaging
|
| API built on top of the <a href='http://handlebarsjs.com'>Handlebars</a>
|
| templating library, and it should give you everything you need to get going.
|
| @@ -94,7 +94,7 @@
|
| In order to do something interesting with the sandboxed file, we need to load
|
| it in a context where it can be addressed by the extension's code. Here,
|
| <a href='/extensions/examples/howto/sandbox/sandbox.html'>sandbox.html</a>
|
| - has been loaded into the extension's <a href='event_pages.html'>Event
|
| + has been loaded into the extension's <a href='event_pages'>Event
|
| Page</a> (<a href='/extensions/examples/howto/sandbox/eventpage.html'>eventpage.html</a>)
|
| via an <code>iframe</code>. <a href='/extensions/examples/howto/sandbox/eventpage.js'>eventpage.js</a>
|
| contains code that sends a message into the sandbox whenever the browser
|
| @@ -187,7 +187,7 @@ chrome.browserAction.onClicked.addListener(function() {
|
| <p>
|
| Back in the Event Page, we'll receive this message, and do something
|
| interesting with the <code>html</code> data we've been passed. In this case,
|
| - we'll just echo it out via a <a href='desktop_notifications.html'>Desktop
|
| + we'll just echo it out via a <a href='desktop_notifications'>Desktop
|
| Notification</a>, but it's entirely possible to use this HTML safely as part
|
| of the extension's UI. Inserting it via <code>innerHTML</code> doesn't pose a
|
| significant security risk, as even a complete compromise of the sandboxed code
|
|
|