Are there any security drawbacks of storing CSS code into an SQL Database?

Question

Let's say that I have a CSS code written by a user like this:

.some-classname {
color: red;
padding: 32px;
background-color: hotpink;
font-size: 24px;
border-radius: 4px;
font-family: 'test font family', serif;

@media screen (max-width: 500px) {
font-size: 25px;
}

I want to store this CSS into an SQL table with two columns, id would be the id of some page on my app, and css which will hold the code above.

the application will query this css string and print it into the page in the head tag between style tags.

Are there any drawbacks and security issues for doing this? note that the user can write any css code that will be stored in the database

Its' a general purpose question

Rohit Gupta · Accepted Answer · 2023-01-02 13:08:58Z

1

CSS by its very nature is accessible to everyone that browses your site. If they wanted to steal it, they just have to copy it. It is public.

Therefore, it does not matter where you store it on your site.

Theoretically, security risk comes from the user writing their own CSS. But if that is all they are doing, they are not writing HTML or JavaScript, then there is a negligible security risk. They could load any resource such as an image from anywhere. You may want to detect this and disallow it.

To be safer, I would suggest that you could implement CSP (Content Security Policies) to control where images, fonts, scripts etc can come from. A useful site is Probely to help you set them up.

I am not associated with that site.

answered Jan 2, 2023 at 13:08

Rohit Gupta

4,27723 gold badges36 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Douara Abderrahman Over a year ago

Thanks for the quick reply Rohit, In that sense, there's no difference between storing the css in the database or writing it to a css file, as it all depends on the developer who is writing this code and only when they are loading resources from abroad

Rohit Gupta Over a year ago

Correct. If there are going to be many hundreds of instances of it then a database will be easier to manage.

Rohit Gupta Over a year ago

If you feel that the answer is correct, you can tick it to indicate it so.

Collectives™ on Stack Overflow

Are there any security drawbacks of storing CSS code into an SQL Database?

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related