Problem

Chrome 57+ has new functionality XSS_AUDITOR: detects unusual code on this page and blockes it to protect your personal information (for example, passwords, phone numbers, and credit cards).

Steps to reproduce

1. Access JIRA using Chrome browser
2. Go to Announcement Banner
3. Enter a script e.g.:

   <script>
    function() {
      var testVar = "/rest/api/2.0/issue";
   
      function testScript ($field, testParam) {
        if (!testParam || testParam.length === 0) {
          testFunc($field);
        }
      }
    }
   </script>
   

4. Click Set Banner

Expected behavior

Chrome displays no error

Actual behavior

Chrome displays an error page warning that the used script might contain unusual code: ERR_BLOCKED_BY_XSS_AUDITOR

Notes

1. Despite the error page:
   • The script is saved successfully and works as intended
   • Other JIRA pages can be accessed normally and going back to Announcement Banner page shows no problem
2. Firefox doesn't display an error page

See related pages regarding to Chrome:

• https://stackoverflow.com/questions/43249998/chrome-err-blocked-by-xss-auditor-details
• https://www.bmyers.com/public/Bypassing-the-XSS-AUDITOR-error-in-Chrome.cfm