I'm considering allowing users to create their own CSS through linked stylesheets (NOT embedded style tags). Can an XSS attack be performed from a stylesheet?
In Internet Explorer, Firefox and other browsers you can embed JavaScript in CSS by specifying a javascript: URL in a url() CSS statement.
Even if you manage to filter these out, an attacker can still completely redesign the page (including all of its textual content) with advanced CSS. Therefore, it becomes extremely easy to trick users to execute stupid actions, which is what XSS is about. For example, you could make the Delete Account button fill the entire window and change its text to "Click here to win 1000$".
You can white-list a select few properties (text-*, font-*, color, background (only colors and gradients, no URLs or other fancy stuff)), but you'll have to reject anything that does not match these restrictions.
Interesting question. I can imagine the style sheet having the ability to remove or hide elements which can be a security problem. You can also insert text after a certain element using :after and :before so you might want to be careful about that.
Alternately I think you should include their style sheet first so that they don't suddenly change all your fonts or something global.
发布评论
评论（3）
在 Internet Explorer 中，Firefox 和其他浏览器，您可以通过在 CSS 中指定
javascript:URL 来将 JavaScript 嵌入到 CSS 中url()CSS 语句。即使您设法过滤掉这些内容，攻击者仍然可以使用高级 CSS 完全重新设计页面（包括其所有文本内容）。因此，欺骗用户执行愚蠢的操作变得非常容易，这就是 XSS 的含义。例如，您可以让
删除帐户按钮填满整个窗口，并将其文本更改为“单击此处赢取 1000 美元”。您可以将选定的几个属性列入白名单（
text-*、font-*、color、background（只有颜色和渐变，没有 URL 或其他花哨的东西）），但您必须拒绝任何不符合这些限制的内容。In Internet Explorer, Firefox and other browsers you can embed JavaScript in CSS by specifying a
javascript:URL in aurl()CSS statement.Even if you manage to filter these out, an attacker can still completely redesign the page (including all of its textual content) with advanced CSS. Therefore, it becomes extremely easy to trick users to execute stupid actions, which is what XSS is about. For example, you could make the
Delete Accountbutton fill the entire window and change its text to "Click here to win 1000$".You can white-list a select few properties (
text-*,font-*,color,background(only colors and gradients, no URLs or other fancy stuff)), but you'll have to reject anything that does not match these restrictions.有趣的问题。我可以想象样式表能够删除或隐藏可能存在安全问题的元素。您还可以使用 :after 和 :before 在某个元素之后插入文本，因此您可能需要小心这一点。
或者，我认为您应该首先包含他们的样式表，这样他们就不会突然更改您的所有字体或全局内容。
Interesting question. I can imagine the style sheet having the ability to remove or hide elements which can be a security problem. You can also insert text after a certain element using :after and :before so you might want to be careful about that.
Alternately I think you should include their style sheet first so that they don't suddenly change all your fonts or something global.
这些都是老黑客，但可能仍然可以在旧浏览器中工作，例如您可以将 javascript 协议放在 href attr 中。
http://ha.ckers.org/xss.html
（搜索风格）
those are old hacks but might still work in older browser, for example you can put javascript protocol in href attr.
http://ha.ckers.org/xss.html
(search for style)