谁能解释"match_about_blank"的用途是什么?在chrome扩展程序的清单文件中? [英] Can anyone explain that what is the use of "match_about_blank" in chrome extension's manifest file?

问题描述

我是chrome扩展的新手，但无法了解清单文件中"match_about_blank"属性的使用.谁能用简单的话来解释?

I am new to chrome extensions but failed to know about the use of "match_about_blank" property in manifest file. Can anyone explain in easy words ?

推荐答案

让我首先引用"match_about_blank"的文档:

是否在about:blank和about:srcdoc上插入内容脚本.仅当内容脚本的继承URL与matches字段中声明的模式之一匹配时，内容脚本才会注入到页面上.继承URL是创建框架或窗口的文档的URL. 内容脚本不能插入沙盒框架中.

Whether to insert the content script on about:blank and about:srcdoc. Content scripts will only be injected on pages when their inherit URL is matched by one of the declared patterns in the matches field. The inherit URL is the URL of the document that created the frame or window. Content scripts cannot be inserted in sandboxed frames.

要完全理解这一点，一些概念是必要的:

To fully understand this, some concepts are necessary:

• 同源政策 是浏览器的一项基本安全功能，它强制执行以下操作:如果文档来自同一来源，则网页只能在其他框架或窗口中运行脚本.

• The same-origin policy is a fundamental security feature of browsers that enforces that web pages can only run scripts in other frames or windows if the documents are served from the same origin.

通常，页面的来源"可以通过查看URL来确定.在某些情况下是不可能的，包括"about:blank"，"about:srcdoc"和沙盒框架.

• "about:blank"是空白页.当您创建一个空框架(例如<iframe>)或打开一个新窗口(window.open())时，URL为"about:blank". 要允许打开程序在此页面中运行脚本，空白页的起源与打开窗口/框架的页面/框架相同.

• "about:blank" is a blank page. When you create an empty frame (e.g.<iframe>) or open a new window (window.open()), the URL is "about:blank". To allow the opener to run scripts in this page, the blank page has the same origin as the page/frame that opened the window/frame.

"about:srcdoc"是框架的URL，其内容是通过

"about:srcdoc" is the URL of a frame whose content is set via the srcdoc attribute of an iframe, and inherits the origin of the parent window, similar to "about:blank" frames.

Chrome扩展程序无法在其他网站上运行脚本，除非它们明确请求该网站的权限，要么通过部分中声明主机权限，或者通过在部分.

Chrome extensions cannot run scripts in other websites, unless they explicitly request permission for that website, either by declaring host permissions in the "permissions" section of manifest.json, or by listing a site in the "matches" section of a content script.

当内容脚本的URL与manifest.json中的"matches"键匹配时，它们将在页面(和框架)中运行. 过去，不可能直接在空白帧中运行脚本，因为"about:blank"无法通过匹配模式进行匹配. 用户(包括广告拦截器的开发人员)要求能够在空白帧中运行脚本(请参见).

Content scripts are run in pages (and frames) when their URL is matched by the "matches" key in manifest.json. In the past, it was not possible to directly run scripts in blank frames, because "about:blank" cannot be matched by a match pattern. Users (including developers of ad blockers) requested the ability to run scripts in blank frames (see issue 76429: Content scripts do not inject into frames with no src because their url is "about:blank").

我建议阅读评论35 如果您对"match_about_blank"键开发的完整历史感兴趣，请继续. 简而言之，"about:blank"匹配模式本身是非常无用的，因为它可以匹配来自所有来源的许多帧.因此，通过引入match_about_blank键(而不是支持"about:blank"匹配模式)来实现运行脚本的功能.

I suggest to read from comment 35 onwards if you are interested in the full history behind the development of the "match_about_blank" key. In short, the "about:blank" match pattern in itself is quite useless since it would match lots of frames from all origins. Hence the ability to run scripts was implemented by introducing a match_about_blank key (instead of supporting an "about:blank" match pattern).

因此，如果要在空白帧中运行脚本，则应该仅使用"match_about_blank":true . 大多数扩展程序还应设置 "all_frames": true (否则，脚本仅在空白的top-级别框架，而不是子框架).因此，要在example.com中运行脚本并从中打开所有空白框架/窗口，请在manifest.json中使用以下命令:

So you should only use "match_about_blank":true if you want to run scripts in blank frames. Most extensions should also set "all_frames": true (otherwise the script only runs in blank top-level frames, and not child frames). So, to run scripts in example.com and all blank frames/windows opened from it, use the following in manifest.json:

...
"content_scripts": [{
    "js": ["contentscript.js"],
    "matches": ["*://*.example.com/*"],
    "all_frames": true,
    "match_about_blank": true
}]
...

这里有一些例子来说明上述内容脚本声明的效果.

Here are some examples to show the effect of the above content script declaration.

This page is at https://example.com/index.html
<!-- Content script will run here -->

<!-- This frame is about:blank, at the same origin as https://example.com -->
<iframe></iframe> <!-- Content script runs in the frame too -->

<!-- This frame is about:srcdoc, at the same origin as https://example.com -->
<iframe srcdoc="test"></iframe> <!-- Content script runs in the frame too -->

<!-- This frame is about:blank, but with a unique origin -->
<iframe sandbox=""></iframe> <!-- No content script -->

<!-- This frame is about:blank, at the same origin as https://example.com -->
<iframe sandbox="allow-same-origin"></iframe>
<!-- Content script runs in the above frame too -->

注意:如果开瓶器本身也是空白框架，则使用开瓶器的开瓶器，直到找到一个非空白的开瓶器为止.如果没有这样的开启程序，或者如果开启程序与"matches"模式不匹配，则内容脚本将不会运行.

Note: If the opener itself is also a blank frame, then the opener of the opener is used, until either an non-blank opener is found. If there is no such opener, or if the opener does not match the "matches" pattern, then the content script does not run.

类似地，使用 chrome.tabs.executeScript 动态插入的内容脚本是仅在matchAboutBlank为true 并且且扩展名有权在该框架或选项卡的(最近非空白)开启程序中运行脚本时，才在空白框架中运行.

Similarly, content scripts that are dynamically inserted using chrome.tabs.executeScript are only run in blank frames if matchAboutBlank is true and the extension has the permission to run scripts in the (nearest non-blank) opener of that frame or tab.

这篇关于谁能解释"match_about_blank"的用途是什么?在chrome扩展程序的清单文件中?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！