Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Anda menggunakan daftar yang diizinkan untuk menetapkan URL tertentu yang telah disetujui sebelumnya untuk diakses oleh skrip atau add-on Anda. Daftar yang diizinkan membantu melindungi data pengguna; saat Anda menentukan daftar yang diizinkan, project skrip tidak dapat mengakses URL yang belum ditambahkan ke daftar yang diizinkan.
Kolom ini bersifat opsional saat Anda menginstal deployment pengujian, tetapi diperlukan saat
Anda membuat deployment versi.
Anda menggunakan daftar yang diizinkan saat skrip atau add-on Anda melakukan tindakan berikut:
Mengambil atau mem-fetch informasi dari lokasi eksternal (seperti endpoint HTTPS) menggunakan layanan UrlFetch
Apps Script. Untuk memasukkan URL ke daftar yang diizinkan untuk pengambilan, sertakan kolom urlFetchWhitelist dalam file manifes Anda.
Membuka atau menampilkan URL sebagai respons terhadap tindakan pengguna (Wajib untuk
add-on Google Workspace yang membuka atau menampilkan URL yang bersifat eksternal bagi
Google). Untuk memasukkan URL dalam daftar yang diizinkan untuk dibuka, sertakan kolom addOns.common.openLinkUrlPrefixes dalam
file manifes Anda.
Menambahkan awalan ke daftar yang diizinkan
Saat menentukan daftar yang diizinkan dalam file manifes (dengan menyertakan kolom
addOns.common.openLinkUrlPrefixes atau urlFetchWhitelist), Anda harus
menyertakan daftar awalan URL. Awalan yang Anda tambahkan ke manifes harus memenuhi persyaratan berikut:
Setiap awalan harus berupa URL yang valid.
Setiap awalan harus menggunakan https://, bukan http://.
Setiap awalan harus memiliki domain lengkap.
Setiap awalan harus memiliki jalur yang tidak kosong. Misalnya, https://www.google.com/
valid, tetapi https://www.google.com tidak.
Anda dapat menggunakan karakter pengganti untuk mencocokkan awalan subdomain URL.
Satu karakter pengganti * dapat digunakan di kolom
addOns.common.openLinkUrlPrefixes
untuk mencocokkan semua link, tetapi hal ini tidak direkomendasikan karena dapat membuat data pengguna berisiko dan dapat memperpanjang proses
peninjauan add-on. Gunakan karakter pengganti hanya jika fungsi add-on Anda memerlukannya.
Saat menentukan apakah URL cocok dengan awalan dalam daftar yang diizinkan, aturan berikut berlaku:
Pencocokan jalur peka huruf besar/kecil.
Jika awalan sama dengan URL, maka itu adalah kecocokan.
Jika URL sama atau merupakan turunan dari awalan, maka URL tersebut cocok.
Misalnya, awalan https://example.com/foo cocok dengan URL berikut:
https://example.com/foo
https://example.com/foo/
https://example.com/foo/bar
https://example.com/foo?bar
https://example.com/foo#bar
Menggunakan karakter pengganti
Anda dapat menggunakan satu karakter pengganti (*) untuk mencocokkan subdomain untuk kolom
urlFetchWhitelist
dan addOns.common.openLinkUrlPrefixes. Anda tidak dapat menggunakan lebih dari satu karakter pengganti untuk mencocokkan beberapa subdomain, dan
karakter pengganti harus mewakili awalan URL.
Misalnya, awalan https://*.example.com/foo cocok dengan URL berikut:
https://subdomain.example.com/foo
https://any.number.of.subdomains.example.com/foo
Awalan https://*.example.com/footidak cocok dengan URL berikut:
https://subdomain.example.com/bar (akhiran tidak cocok)
https://example.com/foo (setidaknya satu subdomain harus ada)
Beberapa aturan awalan diterapkan saat Anda mencoba menyimpan manifes. Misalnya, awalan berikut menyebabkan error jika ada dalam manifes saat Anda mencoba menyimpan:
https://*.*.example.com/foo (beberapa karakter pengganti dilarang)
https://subdomain.*.example.com/foo
(karakter pengganti harus digunakan sebagai awalan utama)
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Informasi yang saya butuhkan tidak ada","missingTheInformationINeed","thumb-down"],["Terlalu rumit/langkahnya terlalu banyak","tooComplicatedTooManySteps","thumb-down"],["Sudah usang","outOfDate","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Masalah kode / contoh","samplesCodeIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-31 UTC."],[[["\u003cp\u003eAllowlists specify approved URLs for your script or add-on to access, enhancing user data protection by restricting access to unlisted URLs.\u003c/p\u003e\n"],["\u003cp\u003eAllowlists are necessary for scripts that fetch external data or open external links, especially for versioned deployments and Google Workspace Add-ons.\u003c/p\u003e\n"],["\u003cp\u003eWhen defining allowlists, use HTTPS prefixes with full domains, non-empty paths, and optional wildcards for subdomains, ensuring adherence to specific formatting rules.\u003c/p\u003e\n"],["\u003cp\u003eAllowlist prefixes are matched against URLs based on case-sensitive path comparisons, allowing access to identical URLs or child paths of the prefix.\u003c/p\u003e\n"],["\u003cp\u003eWildcards can represent subdomains in allowlist prefixes but must be used as the leading prefix and cannot be used to match multiple subdomains simultaneously.\u003c/p\u003e\n"]]],[],null,["# Allowlist URLs\n\nYou use allowlists to designate specific URLs that are pre-approved for access\nby your script or add-on. Allowlists help protect user\ndata; when you define an allowlist, script projects can't access URLs that have\nnot been added to the allowlist.\n\nThis field is optional when you install a test deployment, but is required when\nyou create a versioned deployment.\n\nYou use allowlists when your script or add-on performs\nthe following actions:\n\n- Retrieves or fetches information from an external location (such as HTTPS endpoints) using the Apps Script [`UrlFetch`](/apps-script/reference/url-fetch) service. To allowlist URLs for fetching, include the [`urlFetchWhitelist`](/apps-script/manifest#Manifest.FIELDS.urlFetchWhitelist) field in your manifest file.\n- Opens or displays a URL in response to a user action (Required for Google Workspace add-ons that open or display URLs that are external to Google). To allowlist URLs for opening, include the [`addOns.common.openLinkUrlPrefixes`](/apps-script/manifest/addons#Common.FIELDS.openLinkUrlPrefixes) field in your manifest file.\n\n| **Note:** *Whitelist* , as used in [`urlFetchWhitelist`](/apps-script/manifest#Manifest.FIELDS.urlFetchWhitelist), is a deprecated term that is synonymous with and replaced by *allowlist* . For more information, see [Writing inclusive documentation](https://developers.google.com/style/inclusive-documentation).\n\n### Adding prefixes to your allowlist\n\nWhen you specify allowlists in your manifest file (by including either the\n`addOns.common.openLinkUrlPrefixes` or `urlFetchWhitelist` field), you must\ninclude a list of URL prefixes. The prefixes you add to the manifest must\nsatisfy the following requirements:\n\n- Each prefix must be a valid URL.\n- Each prefix must use `https://`, not `http://`.\n- Each prefix must have a full domain.\n- Each prefix must have a non-empty path. For example, `https://www.google.com/` is valid but `https://www.google.com` is not.\n- You can use [wildcards](#using_wildcards) to match URL subdomain prefixes.\n- A single `*` wildcard can be used in the [`addOns.common.openLinkUrlPrefixes`](/apps-script/manifest/addons#Common.FIELDS.openLinkUrlPrefixes) field to match all links, but this is not recommended as it can expose a user's data to risk and can prolong the [add-on review](/workspace/add-ons/concepts/gsuite-addon-review) process. Only use a wildcard if your add-on functionality requires it.\n\nWhen determining if a URL matches a prefix in the allowlist, the following rules\napply:\n\n- Path matching is case-sensitive.\n- If the prefix is identical to the URL, it is a match.\n- If the URL is the same or a child of the prefix, it is a match.\n\nFor example, the prefix `https://example.com/foo` matches the following URLs:\n\n- `https://example.com/foo`\n- `https://example.com/foo/`\n- `https://example.com/foo/bar`\n- `https://example.com/foo?bar`\n- `https://example.com/foo#bar`\n\n### Using wildcards\n\nYou can use a single wildcard character (`*`) to match a subdomain for both the\n[`urlFetchWhitelist`](/apps-script/manifest#Manifest.FIELDS.urlFetchWhitelist)\nand [`addOns.common.openLinkUrlPrefixes`](/apps-script/manifest/addons#Common.FIELDS.openLinkUrlPrefixes)\nfields. You can't use more than one wildcard to match multiple subdomains, and\nthe wildcard must represent the leading prefix of the URL.\n\nFor example, the prefix `https://*.example.com/foo` matches the following\nURLs:\n\n- `https://subdomain.example.com/foo`\n- `https://any.number.of.subdomains.example.com/foo`\n\nThe prefix `https://*.example.com/foo` *doesn't* match the following\nURLs:\n\n- `https://subdomain.example.com/bar` (suffix mismatch)\n- `https://example.com/foo` (at least one subdomain must be present)\n\nSome of the prefix rules are enforced when you try to save your manifest. For\nexample, the following prefixes cause an error if they are present in your\nmanifest when you attempt to save:\n\n- `https://*.*.example.com/foo` (multiple wildcards are forbidden)\n- `https://subdomain.*.example.com/foo` (wildcards must be used as a leading prefix)"]]
