What CSS is considered Safe or Unsafe within a multi tenant website?

Question

I'm reading the Azure Patterns and Practices multi-tenant guidance and in there it says

Cascading style sheets Behaviors are one feature that the Surveys site will not support.

What CSS features should I support in a multi tenant website?

Answer 1

There are two issues.

1. CSS can contain Javascript. Older browsers will execute the Javascript. The Javascript receives all of the privileges accorded to the web site, so this would allow each tenant to gain privileges he/she should not receive (e.g., privileges to mess with other tenants, or to mess with your surrounding site). For instance, the Samy worm and a recent Facebook vulnerability both involved malicious CSS.

   Newer browsers will not execute the Javascript, but there are still many older browsers out there. Ways of including Javascript or other active content in CSS include expressions like url(javascript:alert()), url("http://evil.com/evil.js"), expression(alert()), -moz-binding:, behavior:, and possibly others.

2. CSS from one tenant can try to set styles on the HTML for other tenants, or for your surrounding site. This might cause negative impacts.

In principle, you could write a CSS sanitizer to defend against these attacks and still allow tenants to specify their own CSS. However, that is quite tricky to do right and it would be easy to introduce a mistake, so it's not something to undertake lightly.

Answer 2

The article is vague about it, but I would hazard a guess that they were referring to blocking content like JavaScript.