Refused to execute inline script because it violates the following Content Security Policy directive

问题描述：

在popup.html页面中使用JavaScript脚本报错，错误详情如下：

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' blob: filesystem: chrome-extension-resource:". Either the 'unsafe-inline' keyword, a hash ('sha256-lDgaSYqVR2ZZR/bWhKwz9AVnrM/j8AgWS8+Cs/dASfI='), or a nonce ('nonce-...') is required to enable inline execution.

根据错误定位到语句，如下语句出错：

<script type="text/javascript" src="js/jquery-1.8.2.min.js"></script>
<script type="text/javascript">//运行到此处出错
$(".click-oc1").click(function(){
      window.open("http://www.oceancoder.cn");
    })
</script>

解决方法一：

将代码保存为独立的js文件，然后动态引用即可。

<script type="text/javascript" src="js/jquery-1.8.2.min.js"></script>
<script type="text/javascript" src="js/func.js"></script>//将上述代码保存到独立文件func.js即可

解决方法二：

添加script-src * 'unsafe-inline'，对于页面内部标签不进行安全验证。修改后如下

<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *;script-src * 'unsafe-inline'">