X-XSS-Protection false positive?

Question

I encounter a strange behavior with my webapp into safari (no problem at all with FF).

The code is pretty simple :

I have a form which contains some checkboxes.
I click on the submit button, which send the data via POST to the same page, in which a PHP script writes a cookie
then, PHP reloads the same page with header("Location:index.php");

Unfortunately, I get the following error with Safari :

"Refused to execute a JavaScript script. Source code of script found within request."

The page does NOT send javascript or URL or other malicious code. It just POST datas from a form. So, how could I avoid this ? Could anyone explain why safari tells me I want to execute javascript code ? (Of course, adding "header("X-XSS-Protection: 0");" in top of the page fixes the problem. But I'm not very happy with this kind of countermeasure...)

This is some relevant parts of the code (simplified):

<?php
if(@$_POST["foo"] == "yes"){
    $choice = join("-", $_POST["choice"]);
    setcookie("bar",$choice, time()+900000);
    header("Location:index.php");
    }
?>


<form method="post" action="index.php">
<input type="hidden" name="foo" value="yes">
<p><input type='checkbox' name='choice[]' value='foo'> foo</p>
<p><input type='checkbox' name='choice[]' value='bar'> bar</p>
<p><input type='checkbox' name='choice[]' value='baz'> baz</p>
<input type="submit">
</form>

Thanks in advance for your responses !

EDIT :

I strongly suspect a bug in my favourite version of Safari (5) since the code is working perfectly in safari 6 (ML), firefox and chrome.
Putting the setcookie section on the top of the page and call "exit" right after header("location:") doesn't fix the problem.
Even if I put the setcookie in a separate PHP script and reload the page from within this new page, I got the same error in safari 5.

As requested by silverlightfox, here are some screenshots of the http response headers of the 2 pages :

headers of the page which set the cookie

headers of the page reloaded

Not sure, but can you name your input choice[]? Should it just be choice? — Sablefoste
@Sable Of course he can, and must if he wants an array. That has nothing to do with the problem — Damien Pirsy
Can you add to your answer the full HTTP response of the page that causes the error to appear? — SilverlightFox
I suspect that this warning comes from the square brackets in the name name='choice[]', could you try without the brackets like this: name='choice'? — martinstoeckli

SilverlightFox SilverlightFox · Accepted Answer · 2014-04-29T06:46:01

After setting the Location header, you should make a call to exit.

This will prevent any more processing of your page, and the rest of the response will not be sent to the browser (the HTML content will still be sent, even though you are redirecting if you do not call exit).

My guess is that there is output of an unencoded parameter somewhere in your page (not present in your code snippet in your question). View the page output to see if your HTML content is inadvertently generating any JavaScript code in the HTTP response body after the redirect header is sent.

X-XSS-Protection false positive?

1 Answers