Chrome App : Refused to execute inline script because it violates the following Content Security Policy directive

Question

I did some research on the same thread and tried the answers that I got. But still, the same error throws every time.

In my case, it's a chrome app and on one page I'm using an iframe and I'm pointing src into some XHTML content. That actually contain some inline style and scripts, which I cant remove or change.

Below is my manifest file.

{
    "manifest_version": 2,
    "name": "*****",
    "short_name": "****",
    "version": "*****",
    "permissions": [""],
    "content_security_policy": "default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; object-src 'self' 'unsafe-inline' 'unsafe-eval'",
    "app": {
        "background": {
            "scripts": ["chrome.js"]
        }
    },
    "icons": {
        "16": "1.png",
        "48": "2.png",
        "128": "3.png"
        },
    "sandbox": {
        "pages": [
            "****.html"
        ]
    }
}

This might help https://stackoverflow.com/questions/3102819/disable-same-origin-policy-in-chrome — Pranoy Sarkar, Jul 19 '17 at 04:51

score 2 · Answer 1 · answered Jul 19 '17 at 05:48

2

Please refer to the the Content Security Policy guidelines:

Inline Script

Up until Chrome 45, there was no mechanism for relaxing the restriction against executing inline JavaScript. In particular, setting a script policy that includes 'unsafe-inline' will have no effect.

As of Chrome 46, inline scripts can be whitelisted by specifying the base64-encoded hash of the source code in the policy. This hash must be prefixed by the used hash algorithm (sha256, sha384 or sha512). See Hash usage for elements for an example.

answered Jul 19 '17 at 05:48

Alexander Higgins

6,101
1
16
35

I released this app when chrome was 51, that time the same manifest configuration works fine. So are u saying that hashing is the only solution? – freakydev Jul 19 '17 at 06:01
more over that that script coming from the xhtml is dynamic. – freakydev Jul 19 '17 at 09:02
perhaps show the html you are trying to load and explain how you are loading it? – Alexander Higgins Jul 19 '17 at 09:10
main html --------------- Document xyz.xhtml --------------- Document

---

– freakydev Jul 19 '17 at 09:57
It isn't being loaded over https? – Alexander Higgins Jul 19 '17 at 14:53

Chrome App : Refused to execute inline script because it violates the following Content Security Policy directive

1 Answers1