Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(486)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: chrome/common/extensions/docs/manifest.html

Issue 9212044: Improving `content_security_policy` documentation. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Meggin's feedback. Created 8 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « chrome/common/extensions/docs/examples/tutorials/analytics/popup.js ('k') | chrome/common/extensions/docs/samples.html » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 <!DOCTYPE html><!-- This page is a placeholder for generated extensions api doc. Note: 1 <!DOCTYPE html><!-- This page is a placeholder for generated extensions api doc. Note:
2 1) The <head> information in this page is significant, should be uniform 2 1) The <head> information in this page is significant, should be uniform
3 across api docs and should be edited only with knowledge of the 3 across api docs and should be edited only with knowledge of the
4 templating mechanism. 4 templating mechanism.
5 3) All <body>.innerHTML is genereated as an rendering step. If viewed in a 5 3) All <body>.innerHTML is genereated as an rendering step. If viewed in a
6 browser, it will be re-generated from the template, json schema and 6 browser, it will be re-generated from the template, json schema and
7 authored overview content. 7 authored overview content.
8 4) The <body>.innerHTML is also generated by an offline step so that this 8 4) The <body>.innerHTML is also generated by an offline step so that this
9 page may easily be indexed by search engines. 9 page may easily be indexed by search engines.
10 --><html xmlns="http://www.w3.org/1999/xhtml"><head> 10 --><html xmlns="http://www.w3.org/1999/xhtml"><head>
(...skipping 316 matching lines...) Expand 10 before | Expand all | Expand 10 after
327 </li><li> 327 </li><li>
328 <a href="#H2-1">Field details</a> 328 <a href="#H2-1">Field details</a>
329 <ol> 329 <ol>
330 <li> 330 <li>
331 <a href="#app">app</a> 331 <a href="#app">app</a>
332 </li><li> 332 </li><li>
333 <a href="#default_locale">default_locale</a> 333 <a href="#default_locale">default_locale</a>
334 </li><li> 334 </li><li>
335 <a href="#description">description</a> 335 <a href="#description">description</a>
336 </li><li> 336 </li><li>
337 <a href="#content_security_policy">content_security_policy</a>
338 </li><li>
339 <a href="#homepage_url">homepage_url</a> 337 <a href="#homepage_url">homepage_url</a>
340 </li><li> 338 </li><li>
341 <a href="#icons">icons</a> 339 <a href="#icons">icons</a>
342 </li><li> 340 </li><li>
343 <a href="#incognito">incognito</a> 341 <a href="#incognito">incognito</a>
344 </li><li> 342 </li><li>
345 <a href="#key">key</a> 343 <a href="#key">key</a>
346 </li><li> 344 </li><li>
347 <a href="#minimum_chrome_version">minimum_chrome_version</a> 345 <a href="#minimum_chrome_version">minimum_chrome_version</a>
348 </li><li> 346 </li><li>
(...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after
414 <em>// Pick one (or none)</em> 412 <em>// Pick one (or none)</em>
415 "<a href="browserAction.html">browser_action</a>": {...}, 413 "<a href="browserAction.html">browser_action</a>": {...},
416 "<a href="pageAction.html">page_action</a>": {...}, 414 "<a href="pageAction.html">page_action</a>": {...},
417 "<a href="themes.html">theme</a>": {...}, 415 "<a href="themes.html">theme</a>": {...},
418 "<a href="#app">app</a>": {...}, 416 "<a href="#app">app</a>": {...},
419 417
420 <em>// Add any of these that you need</em> 418 <em>// Add any of these that you need</em>
421 "<a href="background_pages.html">background</a>": {...}, 419 "<a href="background_pages.html">background</a>": {...},
422 "<a href="override.html">chrome_url_overrides</a>": {...}, 420 "<a href="override.html">chrome_url_overrides</a>": {...},
423 "<a href="content_scripts.html">content_scripts</a>": [...], 421 "<a href="content_scripts.html">content_scripts</a>": [...],
424 "<a href="#content_security_policy">content_security_policy</a>": "<em>policyS tring</em>", 422 "<a href="contentSecurityPolicy.html">content_security_policy</a>": "<em>polic yString</em>",
425 "<a href="fileBrowserHandler.html">file_browser_handlers</a>": [...], 423 "<a href="fileBrowserHandler.html">file_browser_handlers</a>": [...],
426 "<a href="#homepage_url">homepage_url</a>": "http://<em>path/to/homepage</em>" , 424 "<a href="#homepage_url">homepage_url</a>": "http://<em>path/to/homepage</em>" ,
427 "<a href="#incognito">incognito</a>": "spanning" <em>or</em> "split", 425 "<a href="#incognito">incognito</a>": "spanning" <em>or</em> "split",
428 "<a href="#key">key</a>": "<em>publicKey</em>", 426 "<a href="#key">key</a>": "<em>publicKey</em>",
429 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt ring</em>", 427 "<a href="#minimum_chrome_version">minimum_chrome_version</a>": "<em>versionSt ring</em>",
430 "<a href="#nacl_modules">nacl_modules</a>": [...], 428 "<a href="#nacl_modules">nacl_modules</a>": [...],
431 "<a href="#offline_enabled">offline_enabled</a>": true, 429 "<a href="#offline_enabled">offline_enabled</a>": true,
432 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" }, 430 "<a href="omnibox.html">omnibox</a>": { "keyword": "<em>aString</em>" },
433 "<a href="options.html">options_page</a>": "<em>aFile</em>.html", 431 "<a href="options.html">options_page</a>": "<em>aFile</em>.html",
434 "<a href="#permissions">permissions</a>": [...], 432 "<a href="#permissions">permissions</a>": [...],
(...skipping 51 matching lines...) Expand 10 before | Expand all | Expand 10 after
486 (no HTML or other formatting; 484 (no HTML or other formatting;
487 no more than 132 characters) 485 no more than 132 characters)
488 that describes the extension. 486 that describes the extension.
489 The description should be suitable for both 487 The description should be suitable for both
490 the browser's extension management UI 488 the browser's extension management UI
491 and the <a href="https://chrome.google.com/webstore">Chrome Web Store</a>. 489 and the <a href="https://chrome.google.com/webstore">Chrome Web Store</a>.
492 You can specify locale-specific strings for this field; 490 You can specify locale-specific strings for this field;
493 see <a href="i18n.html">Internationalization</a> for details. 491 see <a href="i18n.html">Internationalization</a> for details.
494 </p> 492 </p>
495 493
496 <h3 id="content_security_policy">content_security_policy</h3>
497
498 <p>
499 A security policy to apply to resources in your extension. You can use this
500 policy to help prevent cross-site scripting vulnerabilities in your extension.
501 By default, the extension system enforces the following policy:
502 </p>
503
504 <pre>script-src 'self'; object-src 'self'</pre>
505
506 <p>
507 Extensions can tighten their policy using the
508 <code>content_security_policy</code> manifest attribute. For example, to
509 specify that your extension loads resources only from its own package, use the
510 following policy:
511 </p>
512
513 <pre>"content_security_policy": "default-src 'self' " </pre>
514
515 <p>
516 If you need to load resources from websites,
517 you can add them to the whitelist.
518 For example, if your extension uses Google Analytics,
519 you might use the following policy:
520 </p>
521
522 <pre>"content_security_policy": "default-src 'self' https://ssl.google-analytics .com"</pre>
523
524 <p>
525 The extension system will prevent you including insecure resources
526 for <code>script-src</code> or <code>object-src</code>. If you are using
527 <code>eval</code> to parse JSON, please consider using <code>JSON.parse</code>
528 instead.
529 </p>
530
531 <p>
532 For details, see the
533 <a href="http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specific ation.dev.html">Content Security Policy specification</a>.
534 </p>
535
536
537 <h3 id="homepage_url">homepage_url</h3> 494 <h3 id="homepage_url">homepage_url</h3>
538 495
539 <p> 496 <p>
540 The URL of the homepage for this extension. The extensions management page (chro me://extensions) 497 The URL of the homepage for this extension. The extensions management page (chro me://extensions)
541 will contain a link to this URL. This field is particularly useful if you 498 will contain a link to this URL. This field is particularly useful if you
542 <a href="hosting.html">host the extension on your own site</a>. If you distribut e your 499 <a href="hosting.html">host the extension on your own site</a>. If you distribut e your
543 extension using the <a href="https://chrome.google.com/webstore">Chrome Web Stor e</a>, 500 extension using the <a href="https://chrome.google.com/webstore">Chrome Web Stor e</a>,
544 the homepage URL defaults to the extension's own page. 501 the homepage URL defaults to the extension's own page.
545 </p> 502 </p>
546 503
(...skipping 767 matching lines...) Expand 10 before | Expand all | Expand 10 after
1314 _uff=0; 1271 _uff=0;
1315 urchinTracker(); 1272 urchinTracker();
1316 } 1273 }
1317 catch(e) {/* urchinTracker not available. */} 1274 catch(e) {/* urchinTracker not available. */}
1318 </script> 1275 </script>
1319 <!-- end analytics --> 1276 <!-- end analytics -->
1320 </div> 1277 </div>
1321 </div> <!-- /gc-footer --> 1278 </div> <!-- /gc-footer -->
1322 </div> <!-- /gc-container --> 1279 </div> <!-- /gc-container -->
1323 </body></html> 1280 </body></html>
OLDNEW
« no previous file with comments | « chrome/common/extensions/docs/examples/tutorials/analytics/popup.js ('k') | chrome/common/extensions/docs/samples.html » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698