Refused to execute inline event handler because of Content-Security-Policy

Question

What do I need to change here so that the JavaScript code works with the manifest version 2 and the security policy?

Screenshot:

Code:

function init()
{
    chrome.tabs.getSelected(null, function(tab)
    {
        url = tab.url;
        if(url.indexOf('chrome://') == -1 && url.indexOf('about:blank') == -1){
            document.main.q.value = url;
        }
    });
}

Answer 1

I got it working after I put the JavaScript code from the HTML file into an own file and added the following to the manifest file:

"content_scripts": [ {"js": [ "popup.html" ], "matches": [ "http://*/" ]} ],
"permissions": [ "tabs" ]

Answer 2

The inline event handler definition must be rewritten in terms of addEventListener and extracted into popup.js， so you should remove the onfocus="this.select()" in your popup.html, and in the popup.js, add the following lines:

document.addEventListener('DOMContentLoaded', function () {
  document.getElementById('address_box').addEventListener('onfocus', this.select);
});