Embedding javascript in a content editor web part triggers XSS Auditor error in Chrome when editing any webpart on the page containing the content editor web part.

Steps to reproduce
1 - Use newest version of Chrome browser (i'm using 33.0.1750.154)
2 - Add Content Editor Web Part to a publishing page in SharePoint 2013
3 - Edit Content Editor Web Part html and set content to:
<a href="javascript:alert('hello');">Some link</a>
4 - Save page, refresh, edit page and click on Edit Properties on any webpart on the page. You should see a lot of these in the browser console:

The XSS Auditor refused to execute a script in 'http://{my site url}/Pages/default.aspx' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.

What to do? I could disable XSS-Protection in the http header, but that seems like a very dirty workaround. Is there any better way to embed javascript in content editor web parts to avoid this error?

This is only an issue in Chrome. My Sharepoint version is 15.0.4551.1508.

  • I've found the HTML Form web part to be a good substitute for the CEWP when it gives me problems with saving. Try that. I've never seen/heard of that error before. Any customizations? Does this only happen in Chrome? – Mike Mar 20 '14 at 14:57
  • The error occurs for me only when the URL has query string like ?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSWebPartPage that is , web part editing pages.. after i save the edits and reload the page without this query string, script executes successfully.. – Abdul Hameed Apr 26 '17 at 12:22

Another option would be to embed JavaScript code via Content Link property.

Steps:

1) Create the following regular text file

   <script type="text/javascript">
   <!-- JS code goes here -->
   </script> 

and upload it into Site Assets library

2) Add a reference to a file via via Content Link web part property

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.