Restricting script execution in CSS

Question

I'm writing a rails app which allows user inputted CSS rules, and I want to restrict script execution. Is disallowing 'binding' (for -moz-binding) and 'behavior' enough? It would be implemented with a simple regex called before save.

Are there other methods of including scripts into css stylesheets?

Fahad Sadah · Accepted Answer · 2010-12-18 09:16:21Z

3

It's been proven, time and time again, that blacklisting doesn't work. Keep a whitelist of CSS you can safely allow.

answered Dec 18, 2010 at 9:16

Fahad Sadah

2,4483 gold badges19 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2020-06-20 09:12:55Z

0

There are numerous methods for XSS. Here's a cheat sheet.

Is it a complete list?

never

Sufficiently creative attackers will find a way of getting by your paltry parsers.

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Dec 18, 2010 at 9:12

zzzzBov

180k57 gold badges328 silver badges375 bronze badges

2 Comments

Fahad Sadah Over a year ago

ha.ckers.org is gone. Additionally, that dealt with script-tag injection in general, as opposed to XSS-in-CSS.

zzzzBov Over a year ago

@fahadsadah i guess i should have checked my bookmark before adding it. I'd been to the page I was trying to link to earlier in the day.

Collectives™ on Stack Overflow

Restricting script execution in CSS

2 Answers 2

Comments

never

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

never

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related