我是一个有用的助手,可以为您翻译文本。
我正在开发一个谷歌浏览器扩展程序,需要包含Facebook的sdk.js文件。但问题在于,由于内容安全策略,我无法使应用程序正常工作。以下是我的部分代码:
manifest.json
事情是我一直在得到这个错误:
我正在开发一个谷歌浏览器扩展程序,需要包含Facebook的sdk.js文件。但问题在于,由于内容安全策略,我无法使应用程序正常工作。以下是我的部分代码:
manifest.json
{
"manifest_version": 2,
"name": "<app-name>",
"description": "<description>",
"version": "0.1",
"permissions": [
"tabs","<all_urls>"
],
"content_scripts": [
{
"matches": [
"http://*/*",
"https://*/*"
],
"js": ["intercept_connections.js"]
}
],
"content_security_policy": "script-src 'self' https://connect.facebook.net/en_US/ 'unsafe-eval'; object-src 'self'",
"background": {
"scripts" : ["background.js"]
},
"browser_action": {
"default_icon": "icon.png",
"default_popup": "popup.html"
}
}
popup.html
<html>
<head>
<title>Facebook Mass Sharer</title>
<script type="text/javascript" src="popup.js"></script>
<script type="text/javascript" src="FbApi.js"></script>
</head>
<body>
<body>
<h1>Post to Facebook</h1>
<button id="postTest">TestMe</button>
</body>
</body>
</html>
popup.js
var handleClick = function() {
postToGroup(<groupID>);
}
var initialize = function() {
var test = document.getElementById('postTest');
test.addEventListener("click",handleClick);
}
window.addEventListener("load", initialize);
FbApi.js(由我制作)
。window.onload = function() {
window.fbAsyncInit = function() {
FB.init({
appId : '<appID>',
xfbml : true,
version : 'v2.1',
oauth : true
});
};
(function(d, s, id){
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) {return;}
js = d.createElement(s); js.id = id;
js.src = "https://connect.facebook.net/en_US/sdk.js";
fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));
}
var postToGroup = function(groupID) {
FB.api(
"/"+groupID+"/feed",
"POST",
{
"message": "This is a test message"
},
function (response) {
if (response && !response.error) {
/* handle the result */
}
}
);
}
事情是我一直在得到这个错误:
Refused to execute JavaScript URL because it violates the following Content Security Policy directive: "script-src https:// 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.
我尝试将"content_security_policy": "script-src 'self' https://connect.facebook.net/en_US/ 'unsafe-eval'; object-src 'self'"
更改为"content_security_policy": "script-src 'self'; object-src 'self'"
或"content_security_policy": "script-src 'self' https://connect.facebook.net/en_US/ 'inline-eval'; object-src 'self'"
,如错误提示所建议的,但没有成功。我该尝试什么?
unsafe-inline
而不是unsafe-eval
。 - abraham