Postman ‘There was an error in evaluating the Pre-request Script’ but pre-request script is empty

postmanpostman-pre-request-script

I have a shared collection on Postman. When I run the request in the shared collection it fails with the following error:

There was an error in evaluating the Pre-request Script: Error: Unexpected token '<' at 1:1 ^

I have tried this with several requests, the simplest request being a GET request to 'http://localhost:8000/v1/resource' with no parameters, authorization, headers, body or pre-request script and the above error still occurs.

Checking postman's console I see the following error:

JSONError: Unexpected token '<' at 1:1 ^

Which matches the one above.

When I duplicate the request and place it outside of the shared collection it works fine.

Not sure what I'm missing?

Best Answer

As it's a shared entity, I suspect that a team member/the Collection creator may have added a script to a different part of the Collection.

There are 3 different levels that a Pre-request Script can be called from in Postman. The Collection level, the Sub-Folder level and the from within a single Request.

More information can be found here:

https://learning.getpostman.com/docs/postman/scripts/pre-request-scripts/#adding-a-pre-request-script-to-a-collection-or-folder

Related Solutions

Javascript – How to run one request from another using Pre-request Script in Postman

As mentioned by KBusc and inspired from those examples you can achieve your goal by setting a pre-request script like the following:

pm.sendRequest({
    url: pm.environment.get("token_url"),
    method: 'GET',
    header: {
        'Authorization': 'Basic xxxxxxxxxx==',
    }
}, function (err, res) {
    pm.environment.set("access_token", res.json().token);
});

Then you just reference {{access_token}} as any other environment variable.

Php – When used correctly, is htmlspecialchars sufficient for protection against all XSS

htmlspecialchars() is enough to prevent document-creation-time HTML injection with the limitations you state (ie no injection into tag content/unquoted attribute).

However there are other kinds of injection that can lead to XSS and:

There are no <script> tags in the document.

this condition doesn't cover all cases of JS injection. You might for example have an event handler attribute (requires JS-escaping inside HTML-escaping):

<div onmouseover="alert('<?php echo htmlspecialchars($xss) ?>')"> // bad!

or, even worse, a javascript: link (requires JS-escaping inside URL-escaping inside HTML-escaping):

<a href="javascript:alert('<?php echo htmlspecialchars($xss) ?>')"> // bad!

It is usually best to avoid these constructs anyway, but especially when templating. Writing <?php echo htmlspecialchars(urlencode(json_encode($something))) ?> is quite tedious.

And... injection issues can happen on the client-side as well (DOM XSS); htmlspecialchars() won't protect you against a piece of JavaScript writing to innerHTML (commonly .html() in poor jQuery scripts) without explicit escaping.

And... XSS has a wider range of causes than just injections. Other common causes are:

allowing the user to create links, without checking for known-good URL schemes (javascript: is the most well-known harmful scheme but there are more)
deliberately allowing the user to create markup, either directly or through light-markup schemes (like bbcode which is invariably exploitable)
allowing the user to upload files (which can through various means be reinterpreted as HTML or XML)

Best Answer

Related Solutions

Javascript – How to run one request from another using Pre-request Script in Postman

Php – When used correctly, is htmlspecialchars sufficient for protection against all XSS

Related Topic