Could someone please explain how this Chrome extension manifest option is put together?

Question

I'm looking at the http://code.google.com/chrome/extensions/contentSecurityPolicy.html documentation and seeing:

{
  ...,
  "content_security_policy": "script-src 'self' https://example.com; object-src 'self'",
  ...
}

gets me confused... how is that value put together? What are the relevant pieces?

Answer 1

This means that scripts can be loaded only from the same extension and from https://example.com; media files can only be loaded from the extension.

Answer 2

Taken straight off of the same page:

For full details regarding CSP's syntax, please take a look at the Content Security Policy specification.