LPS-40408

Hi @rotty3000,

the problem here is that browser denies to execute JS, that was submitted via WYSIWYG editor.

Example - edit article, add a JS (e.g. inline video or simply <script>AUI();</script>) and publish. Browser won't let execute the script, because parts of the rendered HTML were found in the request to server. Chrome's XSS Auditor thinks it's reflected XSS, though it's valid HTML editor request.

The solution here is to loose XSS protection by disabling browsers XSS Auditor at all for such requests. There should be no security risk in allowing this, because the HTTP requests are portlet action requests (contains p_auth token => no reflected XSS is possible).

Thanks.