Ssrs and script from was blocked due to mime type mismatch

Question

Hi
I'm trying to add a script to my header on my SSRS report. I've been following this link:
http://blogs.infosupport.com/reporting-services-javascript-injection/
I get error stating:
SEC7112: Script from http//####/HCCReportsServer?/ReportsLibrary/script.js was blocked due to mime type mismatch
My code:
="<a href=""javascript:eval(unescape('function addScript(scriptFile){var head = document.getElementsByTagName(\'HEAD\')[0]; var script = document.createElement(\'script\'); script.setAttribute(\'language\', \'JScript\'); script.setAttribute(\'type\', \'text/Javascript\'); script.setAttribute(\'src\', scriptFile); head.appendChild(script);} addScript(\'http://dc1-sqlrs-d02/HCCReportsServer?/ReportsLibrary/script.js\');'))"">inject</a>"
Please help. This is urgent to get it working for a demo.
Thanks

Answer 1

Hi Sunette,
Based on my understanding, you come across an SEC7112 error when you inject JavaScript into the Reporting Services.
In your scenario, you should remove the below setting in the web.config file(Location: C:\inetpub\wwwroot\wss\VirtualDirectories\<your port>).
<add name="X-Content-Type-Options" value="nosniff" />
As we tested in our environment(SQL Server 2012,SharePoint 2013,IE 11), we can inject JavaScript successfully. Please refer our test steps and results:
1. Delete “X-Content-Type-Options" with value "nosniff" within the web.config file (Location: C:\inetpub\wwwroot\wss\VirtualDirectories\80).
2. Design the report as below, then deploy the report to the SharePoint site.
3. Create the script.js file with code below, and upload to the SharePoint site.
function test()
alert("The CHANGEME textbox will actually change…");
//var doc = window.frames[1][1].document;
var el = document.getElementsByTagName('span');
for (var nr=0; nr<el.length; nr++)
if (el[nr].innerHTML == "CHANGEME")
el[nr].innerHTML = "I FEEL LIKE A CHANGED TEXTBOX";
4. Run the report. Click the “inject”->”test”, the final results should look like below:
If you have any question, please feel free to ask.
Best regards,
Qiuyun Yu
Qiuyun Yu
TechNet Community Support