I am using an external JavaScript lib in my chrome extension. I has inline execution, so I get following kind of error
(The error I get on console)
Copied from my answer to a similar question here. For recent versions of Chrome (46+) the current answer is no longer true. unsafe-inline
still has no effect (in both the manifest and in meta
header tags), but per the documentation, you can use the technique described here to relax the restriction.
Hash usage for
elements
The
script-src
directive lets developers whitelist a particular inline script by specifying its hash as an allowed source of script.Usage is straightforward. The server computes the hash of a particular script block’s contents, and includes the base64 encoding of that value in the
Content-Security-Policy
header:Content-Security-Policy: default-src 'self'; script-src 'self' https://example.com 'sha256-base64 encoded hash'
As an example, consider:
manifest.json:
{
"manifest_version": 2,
"name": "csp test",
"version": "1.0.0",
"minimum_chrome_version": "46",
"content_security_policy": "script-src 'self' 'sha256-WOdSzz11/3cpqOdrm89LBL2UPwEU9EhbDtMy2OciEhs='",
"background": {
"page": "background.html"
}
}
background.html:
Result:
I also tested putting the applicable directive in a meta
tag instead of the manifest. While the CSP indicated in the console message did include the content of the tag, it would not execute the inline script (in Chrome 53).
new background.html:
Result: