title: Content-Security-Policy error in google chrome extension making
body: <p>I am making a chrome extension that will open all links on a page in new tabs.</p>
  
  <p>Here are my code files:</p>
  
  <p>manifest.json</p>
  
  <pre><code>{
    "name": "A browser action which changes its icon when clicked.",
    "version": "1.1",
      "permissions": [
      "tabs", "&lt;all_urls&gt;"
    ],
   "browser_action": {     
      "default_title": "links",      // optional; shown in tooltip
      "default_popup": "popup.html"        // optional
    },
   "content_scripts": [
      {
      "matches": [ "&lt;all_urls&gt;" ],
        "js": ["background.js"]
      }
    ],
    "manifest_version": 2
  }
  </code></pre>
  
  <p>popup.html</p>
  
  <pre><code>&lt;!doctype html&gt;
  &lt;html&gt;
    &lt;head&gt;
      &lt;title&gt;My Awesome Popup!&lt;/title&gt;
      &lt;script&gt;
  function getPageandSelectedTextIndex() 
    { 
      chrome.tabs.getSelected(null, function(tab) { 
      chrome.tabs.sendRequest(tab.id, {greeting: "hello"}, function (response) 
      { 
          console.log(response.farewell); 
      }); 
     }); 
          } 
  chrome.browserAction.onClicked.addListener(function(tab) { 
          getPageandSelectedTextIndex(); 
  });
           &lt;/script&gt;
    &lt;/head&gt;
    &lt;body&gt;
      &lt;button onclick="getPageandSelectedTextIndex()"&gt;
        &lt;/button&gt;
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>background.js</p>
  
  <pre><code>chrome.extension.onRequest.addListener(
    function(request, sender, sendResponse) {
      console.log(sender.tab ?
                  "from a content script:" + sender.tab.url :
                  "from the extension");
      if (request.greeting == "hello")
      updateIcon();  
  
  });
  function updateIcon() {
    var allLinks = document.links;
    for (var i=0; i&lt;allLinks.length; i++) {
      alllinks[i].style.backgroundColor='#ffff00';
  
  }
  }
  </code></pre>
  
  <p>Initially I wanted to highlight all the links on the page or mark them in some way; but I get the error "Refused to execute inline script because of Content-Security-Policy".</p>
  
  <p>When I press the button inside the popup, I get this error: <code>Refused to execute inline event handler because of Content-Security-Policy</code>. </p>
  
  <p>Please help me fix these errors, so I can open all links in new tabs using my chrome extension.</p>