Include jquery in options page?

1,060 views
Skip to first unread message

Nige

unread,
Jul 21, 2012, 1:36:51 PM7/21/12
to Chromium-extensions
I'm trying to upgrade to manifest version 2, but my options page is busted.

How do I include jquery in the options page?

I've got a local copy, which according to http://code.google.com/chrome/extensions/contentSecurityPolicy.html should work, but I get the following error when opening the page:

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' chrome-extension-resource:".

Anybody ideas?

Thanks in advance

Nige

John J Barton

unread,
Jul 21, 2012, 2:05:25 PM7/21/12
to Nige, Chromium-extensions
Your options.html cannot have any script tag without 'src' attributes, eg:
<script>
// inline not allowed
</script>
The logic, as I understand it, is that if you page is attacked by JS code, then that JS code can use then inline scripts to run JS code.

jjb
 

Thanks in advance

Nige

--
You received this message because you are subscribed to the Google Groups "Chromium-extensions" group.
To post to this group, send email to chromium-...@chromium.org.
To unsubscribe from this group, send email to chromium-extens...@chromium.org.
For more options, visit this group at http://groups.google.com/a/chromium.org/group/chromium-extensions/?hl=en.


Nige

unread,
Jul 22, 2012, 6:41:29 AM7/22/12
to Chromium-extensions
On 21 Jul 2012, at 19:05, John J Barton wrote:

> On Sat, Jul 21, 2012 at 10:36 AM, Nige <ni...@zaonce.com> wrote:
> I'm trying to upgrade to manifest version 2, but my options page is busted.
>
> How do I include jquery in the options page?
>
> I've got a local copy, which according to http://code.google.com/chrome/extensions/contentSecurityPolicy.html should work, but I get the following error when opening the page:
>
> Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' chrome-extension-resource:".
>
> Anybody ideas?
>
> Your options.html cannot have any script tag without 'src' attributes, eg:
> <script>
> // inline not allowed
> </script>
> The logic, as I understand it, is that if you page is attacked by JS code, then that JS code can use then inline scripts to run JS code.


Hi John

Thanks for the reply.

I think I've worked out what was wrong - the jquery library I was including was 1.4, which seems to cause issues. If I update it to 1.7, the problem goes away.

Cheers,
Nige
Reply all
Reply to author
Forward
0 new messages