I am invoking JavaScript in <h:mandButton> by onclick event.

 <h:mandButton type="submit" 
          value="Next" action="#{bean.save}"    
          onclick="javascript:getHtml();"/>

 function getHtml(){
      document.getElementById('source').value="HTML source of the page";

  }

output HTML for mandButton in IE/Firefox

<input id="Form:submit" name="Form:submit" 
           type="submit" value="Next"
           onclick="var cf = function(){getHtml();};var oamSF = function(){return 
myfaces.oam.submitForm('Form','Form:submit',null,[['sample','sample']]);};return (cf.apply(this, [])==false)? false : oamSF.apply(this, []);">

But in chrome I see the below JavaScript error with the below HTML

Refused to execute a JavaScript script. Source code of script found within request.

<input id="Form:submit" name="Form:submit" 
       type="submit" value="Next" 
       onclick="" >  // onclick is empty

when i went through forums I see this is to prevent against Cross site scripting when there is onclick with POST as explained in this question

Refused to execute a JavaScript script. Source code of script found within request

This happens when some JavaScript code is sent to the server via an HTTP POST request, and the same code es back via the HTTP response. If Chrome detects this situation, the script is refused to run, and you get the error message Refused to execute a JavaScript script. Source code of script found within request.

How can i Fix this ? I am using JSF 2.0 with Apache myfaces implementation.

I am invoking JavaScript in <h:mandButton> by onclick event.

 <h:mandButton type="submit" 
          value="Next" action="#{bean.save}"    
          onclick="javascript:getHtml();"/>

 function getHtml(){
      document.getElementById('source').value="HTML source of the page";

  }

output HTML for mandButton in IE/Firefox

<input id="Form:submit" name="Form:submit" 
           type="submit" value="Next"
           onclick="var cf = function(){getHtml();};var oamSF = function(){return 
myfaces.oam.submitForm('Form','Form:submit',null,[['sample','sample']]);};return (cf.apply(this, [])==false)? false : oamSF.apply(this, []);">

But in chrome I see the below JavaScript error with the below HTML

Refused to execute a JavaScript script. Source code of script found within request.

<input id="Form:submit" name="Form:submit" 
       type="submit" value="Next" 
       onclick="" >  // onclick is empty

when i went through forums I see this is to prevent against Cross site scripting when there is onclick with POST as explained in this question

Refused to execute a JavaScript script. Source code of script found within request

This happens when some JavaScript code is sent to the server via an HTTP POST request, and the same code es back via the HTTP response. If Chrome detects this situation, the script is refused to run, and you get the error message Refused to execute a JavaScript script. Source code of script found within request.

How can i Fix this ? I am using JSF 2.0 with Apache myfaces implementation.

• javascript
• jsf-2
• http-post
• xss

• Did you try just to remove javascrip:? – partlov Commented Feb 16, 2013 at 7:43
• Yes.I tried by removing javascript: but no use. Not able to invoke the javascript. – SRy Commented Feb 17, 2013 at 3:11
• @partlov......Do I get any issue if i call same javascript by using <h:form onsubmit="gethtml()"/> instead of onclick in mandbutton – SRy Commented Feb 17, 2013 at 4:14
• Maybe you need to show some more of your jsf page here. I'm struggling to understand how the javascript code would wind up in the request sent to the server. Have you observed your browser's console to check the generated markup for irregularities? – kolossus Commented Feb 17, 2013 at 21:18
• @kolossus...Hi I have updated my OP.If you see in the output HTML of mandButtonin chrome onclick is empty – SRy Commented Feb 18, 2013 at 20:07

1 Answer 1

How about

<h:mandButton type="submit" 
      value="Next" action="#{bean.save}"    
      onclick="document.getElementById('source').value='HTML source of the page'; 
      return false;"/>

If this works for you than you didn't include or placed your js file properly in your page / project ...

A better solution would be to properly include your js file

like this

<h:outputScript name="js/myFile.js" target="head"/>

Place your myFile.js inside WebContent\resources\js

Than use it like this

<h:mandButton type="submit" 
      value="Next" action="#{bean.save}"    
      onclick="getHtml(); return false;"/>