8

Embedding javascript in a content editor web part triggers XSS Auditor error in Chrome when editing any webpart on the page containing the content editor web part.

Steps to reproduce
1 - Use newest version of Chrome browser (i'm using 33.0.1750.154)
2 - Add Content Editor Web Part to a publishing page in SharePoint 2013
3 - Edit Content Editor Web Part html and set content to:
<a href="javascript:alert('hello');">Some link</a>
4 - Save page, refresh, edit page and click on Edit Properties on any webpart on the page. You should see a lot of these in the browser console:

The XSS Auditor refused to execute a script in 'http://{my site url}/Pages/default.aspx' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.

What to do? I could disable XSS-Protection in the http header, but that seems like a very dirty workaround. Is there any better way to embed javascript in content editor web parts to avoid this error?

This is only an issue in Chrome. My Sharepoint version is 15.0.4551.1508.

2
  • I've found the HTML Form web part to be a good substitute for the CEWP when it gives me problems with saving. Try that. I've never seen/heard of that error before. Any customizations? Does this only happen in Chrome?
    – Mike
    Mar 20, 2014 at 14:57
  • 1
    The error occurs for me only when the URL has query string like ?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSWebPartPage that is , web part editing pages.. after i save the edits and reload the page without this query string, script executes successfully.. Apr 26, 2017 at 12:22

1 Answer 1

7

Another option would be to embed JavaScript code via Content Link property.

Steps:

1) Create the following regular text file

   <script type="text/javascript">
   <!-- JS code goes here -->
   </script> 

and upload it into Site Assets library

2) Add a reference to a file via via Content Link web part property

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.