Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm reading the Azure Patterns and Practices multi-tenant guidance and in there it says

Cascading style sheets Behaviors are one feature that the Surveys site will not support.

What CSS features should I support in a multi tenant website?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

There are two issues.

  1. CSS can contain Javascript. Older browsers will execute the Javascript. The Javascript receives all of the privileges accorded to the web site, so this would allow each tenant to gain privileges he/she should not receive (e.g., privileges to mess with other tenants, or to mess with your surrounding site). For instance, the Samy worm and a recent Facebook vulnerability both involved malicious CSS.

    Newer browsers will not execute the Javascript, but there are still many older browsers out there. Ways of including Javascript or other active content in CSS include expressions like url(javascript:alert()), url("http://evil.com/evil.js"), expression(alert()), -moz-binding:, behavior:, and possibly others.

  2. CSS from one tenant can try to set styles on the HTML for other tenants, or for your surrounding site. This might cause negative impacts.

In principle, you could write a CSS sanitizer to defend against these attacks and still allow tenants to specify their own CSS. However, that is quite tricky to do right and it would be easy to introduce a mistake, so it's not something to undertake lightly.

share|improve this answer
1  
Thanks D.W.! Let me know if you come across any reliable CSS sanitizers; or should I post that as a separate question? –  makerofthings7 Feb 23 '11 at 13:06
1  
I don't know of any reliable standalone CSS sanitizers, though you could look at Google's Caja and Microsoft's WebSandbox projects, which do (I believe) include CSS sanitization. –  D.W. Feb 27 '11 at 7:31

The article is vague about it, but I would hazard a guess that they were referring to blocking content like JavaScript.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.