Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p><strong>UPDATE:</strong></p> <p>Since at least January 2013, Chrome now permits the <a href="https://developer.chrome.com/extensions/contentSecurityPolicy.html#relaxing-eval" rel="noreferrer"><code>unsafe-eval</code></a> Content Security Policy (CSP) directive, which allows <code>eval</code> execution outside of a sandbox:</p> <blockquote> <p>The policy against <code>eval()</code> and its relatives like <code>setTimeout(String)</code>, <code>setInterval(String)</code>, and <code>new Function(String)</code> can be relaxed by adding <strong><code>'unsafe-eval'</code></strong> to your policy</p> </blockquote> <p>Add an appropriate <a href="https://developer.chrome.com/extensions/contentSecurityPolicy.html" rel="noreferrer">CSP</a> to you extension manifest, like:</p> <pre><code>"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'" </code></pre> <hr/> <p>The <a href="http://code.google.com/p/chromium/issues/detail?id=141501" rel="noreferrer">bug you refer to</a> is now marked <code>fixed</code>, and has been included since Chrome 22.</p> <p>Prior to the introduction of <code>'unsafe-eval'</code>, there was no way to have the CSP of a <code>manifest_version: 2</code> extension allow execution of arbitrary text as code. <a href="http://web.archive.org/web/20120812230022/http://developer.chrome.com/extensions/contentSecurityPolicy.html" rel="noreferrer">At the time</a>, Google made it clear there was no way to remove this restriction (outside of sandboxing):</p> <blockquote> <p>Inline JavaScript, as well as dangerous string-to-JavaScript methods like <code>eval</code>, will not be executed... There is no mechanism for relaxing the restriction against executing inline JavaScript. In particular, setting a script policy that includes <code>unsafe-inline</code> will have no effect. This is intentional.</p> </blockquote> <p>As mentioned above, this restriction can now be relaxed.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload