「不安全-EVAL」

Question

我試圖運行以下命令：

chrome.tabs.onCreated.addListener(function (tab){ 
    if (tab.url.indexOf(".salesforce.com/") != -1 || tab.url.indexOf(".force.com/") != -1) { 
     chrome.tabs.executeScript(tab.id, { 
      "file": "loadScript.js" 
     }, function() { 
      console.log("Script Executed .. "); 
     }); 
    } else { 
     var wrongTab = chrome.i18n.getMessage("wrongTab"); 
     console.log(wrongTab); 
     alert(wrongTab); 
    } 
}); 

哪些應該（理論上），在頁面加載運行loadScript.js文件....在loadScript.js文件內容如下，這應該一個文件附加到正在運行的網頁，而不是到後臺頁面，因爲它是目前的樣子：

/* Create a scriipt element in head of HTML and put /soap/ajax/31.0/connection.js in the src */ 
var connectJsUrl = "/connection.js"; 

function loadScript(url, callback) { 
    var head = document.getElementsByTagName("head")[0]; 
    var script = document.createElement("script"); 
    script.src = url; 
    var done = false; 
    script.onload = script.onreadystatechange = function() { 
     if (!done && (!this.readyState || this.readyState == "loaded" || this.readyState == "complete")) { 
      done = true; 
      callback(); 
      script.onload = script.onreadystatechange = null; 
      head.removeChild(script); 
     } 
    }; 
    head.appendChild(script); 
} 

loadScript(connectJsUrl, function() { 
    console.log("Script Confirmed...") 
}); 

/* Check to see if the file have been appended correctly and works correctly */ 
var JSFile = "chrome-extension://" + window.location.host + connectJsUrl; 
var req = (window.XMLHttpRequest) ? new XMLHttpRequest() : new ActiveXObject("Microsoft.XMLHTTP"); 
if (req == null) { 
    console.log("Error: XMLHttpRequest failed to initiate."); 
}; 
req.onload = function() { 
    try { 
     eval(req.responseText); 
    } catch (e) { 
     console.log("There was an error in the script file."); 
    } 
}; 
try { 
    req.open("GET", JSFile, true); 
    req.send(null); 
} catch (e) { 
    console.log("Error retrieving data httpReq. Some browsers only accept cross-domain request with HTTP."); 
}; 

我還是一個新手到Chrome擴展，如果我的.js所以原諒我已經犯了一個愚蠢的錯誤:)

我得到的所有內容如下： 拒絕將字符串評估爲JavaScript，因爲在以下內容安全策略指令中，'unsafe-eval'不是腳本的允許來源：「script-src'self'chrome-extension-資源：」。

Answer 1

爲防止跨站點腳本Google阻止了eval函數。

爲了解決這個這個代碼添加到的manifest.json

"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"`, 

請評論，如果您需要進一步的解釋