Refused to execute a JavaScript script. Source code of script found within request

javascript code-injection
doekman picture doekman · Oct 10, 2009 · Viewed 60.1k times · Source

In WebKit I get the following error on my JavaScript:

Refused to execute a JavaScript script. The source code of script found within request.

The code is for a JavaScript spinner, see ASCII Art.

The code used to work OK and is still working correctly in Camino and Firefox. The error only seems to be thrown when the page is saved via a POST and then retrieved via a GET. It happens in both Chrome/Mac and Safari/Mac.

Anyone know what this means, and how to fix this?

Answer

Kendall Hopkins picture Kendall Hopkins · Mar 2, 2012

This "feature" can be disabled by sending the non-standard HTTP header X-XSS-Protection on the affected page.

X-XSS-Protection: 0

Related questions

How to prevent Javascript injection attacks within user-generated HTML

I am saving user-submitted HTML (in a database). I must prevent JavaScript injection attacks. The most pernicious I have seen is JavaScript in a style="expression(...)". In addition to this, a fair amount of valid user content will include special …

Read More
How to inject jquery to any webpage

Is there any way to inject jQuery into any page as we do with javascript(from url). with javascript we do this javascript:alert("b"); I tried this but I don't know why it dosen't work javascript:var x = document.…

Read More
Is it possible to get data from HTML forms into android while using webView?

I'm making a very simple form in HTML which is viewed in android using the webview which takes in your name using a textbox and when you click on the button, it displays it into a paragraph and it's made …

Read More