Chrome插件和内容安全策略错误

Chrome Plugin and Content Security Policy errors

本文关键字：安全策略 错误 插件 Chrome      更新时间：2023-09-26

上传未打包的Chrome扩展时，我得到以下错误:

Could not load extension from '/Users/me/example'. Invalid value for 'content_security_policy': Both 'script-src' and 'object-src' directives must be specified (either explicitly, or implicitly via 'default-src'), and both must whitelist only secure resources. You may include any of the following sources: "'self'", "'unsafe-eval'", "http://127.0.0.1", "http://localhost", or any "https://" or "chrome-extension://" origin. For more information, see http://developer.chrome.com/extensions/contentSecurityPolicy.html

清单如下所示:

{
  "name": "Example Inc.",
  "manifest_version" : 2,
  "version": "0.4.4",
  "content_scripts": [
    {
      "matches": [
        "*://*.example.cc/*"
      ],
      "js": [
        "production/jquery.libs.min.js",
        "https://example.cc/js/example.js"
      ],
      "run_at": "document_end"
    }
  ],
  "permissions": [
    "*://*.example.cc/*",
    "tabs",
    "activeTab",
    "contextMenus",
    "storage",
    "management",
    "cookies"
  ],
  "content_security_policy": "script-src 'self' https://ssl.google-analytics.com/ga.js https://example.cc/js/*; object-src 'self'"
}

从我看过的所有例子来看，在阅读了一些CSP文档之后，我不确定我错过了什么。我们的域名是完全https, example.js文件存在并且可以访问，等等

欢迎任何想法!

如果你只使用你的代码设置为只自我，例如

"content_security_policy";default-src‘自我’",

你应该这样做:

"content_security_policy": "script-src 'self' https://ssl.google-analytics.com/ga.js https://example.cc; object-src 'self'"
相关文章：