Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Multiple content types specified - false positive

Anders | Last updated: Jan 21, 2016 11:50AM UTC

Just ran into this (relatively minor) false positive. (Burp Pro 1.6.34) The report was issued over a a) Header: Content-Type: application/x-javascript and b) the string: '<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />'; found in the body of the response. The code looks like it may be from tinymce.min.js (where I do find the same code). Not entirely easy to tell the difference between a real meta and a string with meta. The outer single quotes are in the code, though, and might help indicate that it's not a real meta.

PortSwigger Agent | Last updated: Jan 21, 2016 04:06PM UTC

Thanks for this report. Agreed, this is maybe a difficult false positive to eliminate. We could possibly try to parse the response as JS, since that is the stated content type, and see if the META tag lands in a string literal. Depending on how frequently this edge case occurs, it might or might not be worth the effort to do this.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.