Add a warning to the documentation of chrome.tabs.executeScript API

chrome/common/extensions/api/tabs.json

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 [
   {
     "namespace": "tabs",
     "description": "Use the <code>chrome.tabs</code> API to interact with the browser's tab system. You can use this API to create, modify, and rearrange tabs in the browser.",
     "types": [
       {
@@ skipping 17 matching lines @@
           "width": {"type": "integer", "optional": true, "description": "The width of the tab in pixels."},
           "height": {"type": "integer", "optional": true, "description": "The height of the tab in pixels."},
           "sessionId": {"type": "string", "optional": true, "description": "The session ID used to uniquely identify a Tab obtained from the $(ref:sessions) API."}
         }
       },
       {
         "id": "InjectDetails",
         "type": "object",
         "description": "Details of the script or CSS to inject. Either the code or the file property must be set, but both may not be set at the same time.",
         "properties": {
-          "code": {"type": "string", "optional": true, "description": "JavaScript or CSS code to inject."},
+          "code": {"type": "string", "optional": true, "description": "JavaScript or CSS code to inject.<br><br><b>Warning:</b><br>Be careful using the <code>code</code> parameter. Incorrect use of it may open your extension to <a href=\"https://en.wikipedia.org/wiki/Cross-site_scripting\">cross site scripting</a> attacks."},
           "file": {"type": "string", "optional": true, "description": "JavaScript or CSS file to inject."},
           "allFrames": {"type": "boolean", "optional": true, "description": "If allFrames is <code>true</code>, implies that the JavaScript or CSS should be injected into all frames of current page. By default, it's <code>false</code> and is only injected into the top frame."},
           "runAt": {
             "type": "string",
             "optional": true,
             "enum": ["document_start", "document_end", "document_idle"],
             "description": "The soonest that the JavaScript or CSS will be injected into the tab. Defaults to \"document_idle\"."
           }
         }
       }
@@ skipping 868 matching lines @@
         "type": "function",
         "description": "Fired when a tab is replaced with another tab due to prerendering or instant.",
         "parameters": [
           {"type": "integer", "name": "addedTabId", "minimum": 0},
           {"type": "integer", "name": "removedTabId", "minimum": 0}
         ]
       }
     ]
   }
 ]