Embedding javascript in a content editor web part triggers XSS Auditor error in Chrome when editing any webpart on the page containing the content editor web part.
Steps to reproduce
1 - Use newest version of Chrome browser (i'm using 33.0.1750.154)
2 - Add Content Editor Web Part to a publishing page in SharePoint 2013
3 - Edit Content Editor Web Part html and set content to:
<a href="javascript:alert('hello');">Some link</a>
4 - Save page, refresh, edit page and click on Edit Properties on any webpart on the page. You should see a lot of these in the browser console:
The XSS Auditor refused to execute a script in 'http://{my site url}/Pages/default.aspx' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.
What to do? I could disable XSS-Protection in the http header, but that seems like a very dirty workaround. Is there any better way to embed javascript in content editor web parts to avoid this error?
This is only an issue in Chrome. My Sharepoint version is 15.0.4551.1508.
?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSWebPartPage
that is , web part editing pages.. after i save the edits and reload the page without this query string, script executes successfully..