title: Ignoring base tag after post
body: <p>On Chrome I'm getting an error <code>Refused to execute a JavaScript script. Source code of script found within request.</code> after posting data that contains the name of the domain (also note the lack of javascript on either page) .</p>
  
  <p><a href="http://pastehtml.com/view/bp5uczv6h.html" rel="nofollow">badpage1.html</a>:</p>
  
  <pre><code>&lt;form action="/badpage2.html" method="post"&gt;
  &lt;input type="hidden" name="name" value="href=%22http://www.w3.org/%22"/&gt;
  &lt;input type="submit" name="submit"/&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p><a href="http://pastehtml.com/view/bp5uauhop.html" rel="nofollow">badpage2.html</a>:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;base href="http://www.w3.org/"/&gt;
      &lt;/head&gt;
      &lt;body&gt;
          &lt;img src="Icons/w3c_home" alt=""&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>If you go directly to <code>badpage2.html</code> the image will show, but if you go to it via <code>badpage1.html</code>, the image will not show (base tag doesn't work).</p>
  
  <p>Is this a bug in Chrome XSS detection? And if it's not, how would I bypass this? It seems silly to encode the posted data just to bypass this filter.</p>
  
  <p>EDIT:</p>
  
  <p>In my case, the post value sent is to update part of the content of the page. The problem comes if it contains happens to contain the domain name that is used in the <code>&lt;base&gt;</code> (as this example does) it will trigger the XSS detection which disables the <code>&lt;base&gt;</code> tag.</p>