Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(559)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: chrome/common/extensions/docs/apps/manifest.html

Issue 10825056: Update the `sandbox` documentation to point to new workflow docs. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Mihai's feedback. Created 8 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « no previous file | chrome/common/extensions/docs/extensions/manifest.html » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 <!DOCTYPE html><!-- This page is a placeholder for generated extensions api doc. Note: 1 <!DOCTYPE html><!-- This page is a placeholder for generated extensions api doc. Note:
2 1) The <head> information in this page is significant, should be uniform 2 1) The <head> information in this page is significant, should be uniform
3 across api docs and should be edited only with knowledge of the 3 across api docs and should be edited only with knowledge of the
4 templating mechanism. 4 templating mechanism.
5 3) All <body>.innerHTML is genereated as an rendering step. If viewed in a 5 3) All <body>.innerHTML is genereated as an rendering step. If viewed in a
6 browser, it will be re-generated from the template, json schema and 6 browser, it will be re-generated from the template, json schema and
7 authored overview content. 7 authored overview content.
8 4) The <body>.innerHTML is also generated by an offline step so that this 8 4) The <body>.innerHTML is also generated by an offline step so that this
9 page may easily be indexed by search engines. 9 page may easily be indexed by search engines.
10 --><html xmlns="http://www.w3.org/1999/xhtml"><head> 10 --><html xmlns="http://www.w3.org/1999/xhtml"><head>
(...skipping 229 matching lines...) Expand 10 before | Expand all | Expand 10 after
240 "<a href="#default_locale">default_locale</a>": "<em>en</em>", 240 "<a href="#default_locale">default_locale</a>": "<em>en</em>",
241 <em>// Pick one (or none)</em> 241 <em>// Pick one (or none)</em>
242 "<a href="browserAction.html">browser_action</a>": {...}, 242 "<a href="browserAction.html">browser_action</a>": {...},
243 "<a href="pageAction.html">page_action</a>": {...}, 243 "<a href="pageAction.html">page_action</a>": {...},
244 "<a href="themes.html">theme</a>": {...}, 244 "<a href="themes.html">theme</a>": {...},
245 "<a href="#app">app</a>": {...}, 245 "<a href="#app">app</a>": {...},
246 <em>// Add any of these that you need</em> 246 <em>// Add any of these that you need</em>
247 "<a href="background_pages.html">background</a>": {...}, 247 "<a href="background_pages.html">background</a>": {...},
248 "<a href="override.html">chrome_url_overrides</a>": {...}, 248 "<a href="override.html">chrome_url_overrides</a>": {...},
249 "<a href="content_scripts.html">content_scripts</a>": [...], 249 "<a href="content_scripts.html">content_scripts</a>": [...],
250 "<a href="contentSecurityPolicy.html">content_security_policy</a>": "<em>polic yString</em>", 250 "<a href="../extensions/contentSecurityPolicy.html">content_security_policy</a >": "<em>policyString</em>",
251 "<a href="fileBrowserHandler.html">file_browser_handlers</a>": [...], 251 "<a href="fileBrowserHandler.html">file_browser_handlers</a>": [...],
252 "<a href="#homepage_url">homepage_url</a>": "http://<em>path/to/homepage</em>" , 252 "<a href="#homepage_url">homepage_url</a>": "http://<em>path/to/homepage</em>" ,
253 "<a href="#incognito">incognito</a>": "spanning" <em>or</em> "split", 253 "<a href="#incognito">incognito</a>": "spanning" <em>or</em> "split",
254 "<a href="#intents">intents</a>": {...} 254 "<a href="#intents">intents</a>": {...}
255 "<a href="#key">key</a>": "<em>publicKey</em>", 255 "<a href="#key">key</a>": "<em>publicKey</em>",
256 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt ring</em>", 256 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt ring</em>",
257 "<a href="#nacl_modules">nacl_modules</a>": [...], 257 "<a href="#nacl_modules">nacl_modules</a>": [...],
258 "<a href="#offline_enabled">offline_enabled</a>": true, 258 "<a href="#offline_enabled">offline_enabled</a>": true,
259 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" }, 259 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" },
260 "<a href="options.html">options_page</a>": "<em>aFile</em>.html", 260 "<a href="options.html">options_page</a>": "<em>aFile</em>.html",
(...skipping 682 matching lines...) Expand 10 before | Expand all | Expand 10 after
943 <h3 id="sandbox">sandbox</h3> 943 <h3 id="sandbox">sandbox</h3>
944 <p> 944 <p>
945 Defines an collection of app or extension pages that are to be served 945 Defines an collection of app or extension pages that are to be served
946 in a sandboxed unique origin, and optionally a Content Security Policy to use 946 in a sandboxed unique origin, and optionally a Content Security Policy to use
947 with them. Being in a sandbox has two implications: 947 with them. Being in a sandbox has two implications:
948 </p> 948 </p>
949 <ol> 949 <ol>
950 <li>A sandboxed page will not have access to extension or app APIs, or 950 <li>A sandboxed page will not have access to extension or app APIs, or
951 direct access to non-sandboxed pages (it may communicate with them via 951 direct access to non-sandboxed pages (it may communicate with them via
952 <code>postMessage()</code>).</li> 952 <code>postMessage()</code>).</li>
953 <li>A sandboxed page is not subject to the 953 <li>
954 <a href="contentSecurityPolicy.html">Content Security Policy (CSP)</a> used 954 <p>A sandboxed page is not subject to the
955 by the rest of the app or extension (it has its own separate CSP value). This 955 <a href="../extensions/contentSecurityPolicy.html">Content Security Policy (CS P)</a> used
956 means that, for example, it can use inline script and <code>eval</code>.</li> 956 by the rest of the app or extension (it has its own separate CSP value). This
957 </ol> 957 means that, for example, it can use inline script and <code>eval</code>.</p>
958 <p>For example, here's how to specify that two extension pages are to be served 958 <p>For example, here's how to specify that two extension pages are to be
959 in a sandbox with a custom CSP:</p> 959 served in a sandbox with a custom CSP:</p>
960 <pre>{ 960 <pre>{
961 ... 961 ...
962 "sandbox": { 962 "sandbox": {
963 "pages": [ 963 "pages": [
964 "page1.html", 964 "page1.html",
965 "directory/page2.html" 965 "directory/page2.html"
966 ] 966 ]
967 <i>// content_security_policy is optional.</i> 967 <i>// content_security_policy is optional.</i>
968 "content_security_policy": 968 "content_security_policy":
969 "sandbox allow-scripts; script-src https://www.google.com" 969 "sandbox allow-scripts; script-src https://www.google.com"
970 ], 970 ],
971 ... 971 ...
972 }</pre> 972 }</pre>
973 <p> 973 <p>
974 If not specified, the default <code>content_security_policy</code> value is 974 If not specified, the default <code>content_security_policy</code> value is
975 <code>sandbox allow-scripts allow-forms</code>. You can specify your CSP 975 <code>sandbox allow-scripts allow-forms</code>. You can specify your CSP
976 value to restrict the sandbox even further, but it must have the <code>sandbox</ code> 976 value to restrict the sandbox even further, but it must have the <code>sandbox </code>
977 directive and may not have the <code>allow-same-origin</code> token (see 977 directive and may not have the <code>allow-same-origin</code> token (see
978 <a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe- element.html#attr-iframe-sandbox">the 978 <a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/the-ifram e-element.html#attr-iframe-sandbox">the
979 HTML5 specification</a> for possible sandbox tokens). 979 HTML5 specification</a> for possible sandbox tokens).
980 </p> 980 </p>
981 </li>
982 </ol>
981 <p> 983 <p>
982 Note that you only need to list pages that you expected to be loaded in 984 Note that you only need to list pages that you expected to be loaded in
983 windows or frames. Resources used by sandboxed pages (e.g. stylesheets or 985 windows or frames. Resources used by sandboxed pages (e.g. stylesheets or
984 JavaScript source files) do not need to appear in the 986 JavaScript source files) do not need to appear in the
985 <code>sandboxed_page</code> list, they will use the sandbox of the page 987 <code>sandboxed_page</code> list, they will use the sandbox of the page
986 that embeds them. 988 that embeds them.
987 </p> 989 </p>
988 <p> 990 <p>
991 <a href="sandboxingEval.html">"Using eval in Chrome Extensions. Safely."</a>
992 goes into more detail about implementing a sandboxing workflow that enables use
993 of libraries that would otherwise have issues executing under extension's
994 <a href="../extensions/contentSecurityPolicy.html">default Content Security Poli cy</a>.
995 </p>
996 <p>
989 Sandboxed page may only be specified when using 997 Sandboxed page may only be specified when using
990 <a href="#manifest_version"><code>manifest_version</code></a> 2 or above. 998 <a href="#manifest_version"><code>manifest_version</code></a> 2 or above.
991 </p> 999 </p>
992 </div> 1000 </div>
993 <!-- API PAGE --> 1001 <!-- API PAGE -->
994 <!-- /apiPage --> 1002 <!-- /apiPage -->
995 </div> <!-- /gc-pagecontent --> 1003 </div> <!-- /gc-pagecontent -->
996 </div> <!-- /g-section --> 1004 </div> <!-- /g-section -->
997 </div> <!-- /codesiteContent --> 1005 </div> <!-- /codesiteContent -->
998 <div id="gc-footer" --=""> 1006 <div id="gc-footer" --="">
(...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after
1031 _uff=0; 1039 _uff=0;
1032 urchinTracker(); 1040 urchinTracker();
1033 } 1041 }
1034 catch(e) {/* urchinTracker not available. */} 1042 catch(e) {/* urchinTracker not available. */}
1035 </script> 1043 </script>
1036 <!-- end analytics --> 1044 <!-- end analytics -->
1037 </div> 1045 </div>
1038 </div> <!-- /gc-footer --> 1046 </div> <!-- /gc-footer -->
1039 </div> <!-- /gc-container --> 1047 </div> <!-- /gc-container -->
1040 </body></html> 1048 </body></html>
OLDNEW
« no previous file with comments | « no previous file | chrome/common/extensions/docs/extensions/manifest.html » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698