3

I encounter a strange behavior with my webapp into safari (no problem at all with FF).

The code is pretty simple :

  • I have a form which contains some checkboxes.
  • I click on the submit button, which send the data via POST to the same page, in which a PHP script writes a cookie
  • then, PHP reloads the same page with header("Location:index.php");

Unfortunately, I get the following error with Safari :

"Refused to execute a JavaScript script. Source code of script found within request."

The page does NOT send javascript or URL or other malicious code. It just POST datas from a form. So, how could I avoid this ? Could anyone explain why safari tells me I want to execute javascript code ? (Of course, adding "header("X-XSS-Protection: 0");" in top of the page fixes the problem. But I'm not very happy with this kind of countermeasure...)

This is some relevant parts of the code (simplified):

<?php
if(@$_POST["foo"] == "yes"){
    $choice = join("-", $_POST["choice"]);
    setcookie("bar",$choice, time()+900000);
    header("Location:index.php");
    }
?>


<form method="post" action="index.php">
<input type="hidden" name="foo" value="yes">
<p><input type='checkbox' name='choice[]' value='foo'> foo</p>
<p><input type='checkbox' name='choice[]' value='bar'> bar</p>
<p><input type='checkbox' name='choice[]' value='baz'> baz</p>
<input type="submit">
</form>

Thanks in advance for your responses !

EDIT :

  • I strongly suspect a bug in my favourite version of Safari (5) since the code is working perfectly in safari 6 (ML), firefox and chrome.
  • Putting the setcookie section on the top of the page and call "exit" right after header("location:") doesn't fix the problem.
  • Even if I put the setcookie in a separate PHP script and reload the page from within this new page, I got the same error in safari 5.

As requested by silverlightfox, here are some screenshots of the http response headers of the 2 pages :

headers of the page which set the cookie

headers of the page reloaded

Chrysotribax
  • 789
  • 1
  • 9
  • 17
  • Not sure, but can you name your input `choice[]`? Should it just be `choice`? – Sablefoste Apr 28 '14 at 18:10
  • @Sable Of course he can, and must if he wants an array. That has nothing to do with the problem – Damien Pirsy Apr 28 '14 at 18:11
  • Can you add to your answer the full HTTP response of the page that causes the error to appear? – SilverlightFox Apr 29 '14 at 10:27
  • Please see my edits for screenshots of HTTP response. – Chrysotribax Apr 29 '14 at 12:34
  • I suspect that this warning comes from the square brackets in the name `name='choice[]'`, could you try without the brackets like this: `name='choice'`? – martinstoeckli Apr 29 '14 at 12:52
  • hello, martinstoeckli, removing the brackets does not fix the problem at all. Since my form contains an arbitrary number of checkboxes, dynamically created, with values that I don't know, I need the brackets because I want that PHP POST values gives me an array. – Chrysotribax Apr 29 '14 at 14:32
  • I guess it's picking up on the `setcookie` as it is reflecting the POST data. A very strange bug if so! – SilverlightFox Apr 29 '14 at 14:36
  • Just emit `X-XSS-Protection: 0` and you're done. This misfeature should have description of "Apply random modifications to page source to disable JavaScript` because that would better match the actual implementation. – Mikko Rantalainen Aug 30 '19 at 06:09

1 Answers1

2

After setting the Location header, you should make a call to exit.

This will prevent any more processing of your page, and the rest of the response will not be sent to the browser (the HTML content will still be sent, even though you are redirecting if you do not call exit).

My guess is that there is output of an unencoded parameter somewhere in your page (not present in your code snippet in your question). View the page output to see if your HTML content is inadvertently generating any JavaScript code in the HTTP response body after the redirect header is sent.

Community
  • 1
  • 1
SilverlightFox
  • 32,436
  • 11
  • 76
  • 145
  • Thank you for your response, but it's not working in my case. Please see my edit : I think it's just a bug of the browser I use... – Chrysotribax Apr 29 '14 at 10:12
  • @SilverlightFox Notice how the Content-Length header of the redirect response is zero? Nothing is being sent in that response body. – Niet the Dark Absol Apr 29 '14 at 12:37