You can use Content Security Policy to disallow style attributes, but you can just get around this just by using javascript to modify an element's style. Isn't this a security hole or am I missing something?


You can use CSP to block specific sources of stylesheets, but not to disallow particular style attributes. For example, you can disallow inline styles, or disallow remote styles, or both. (If you set style-src: none, I guess it will be like HTML 3.)

If an attacker is executing JavaScript on your site, then you have much, much, bigger problems than their ability to modify the styles on your site. They can hide entire elements (deleting them from the DOM), exfiltrate private data, and take actions as the logged-in user.

CSP is a defense-in-depth mechanism, and is not intended to be the primary trust boundary or control for any system. When I am testing web applications, I report all attempts at script execution (even when blocked by CSP) as an XSS, though I do note those that are mitigated by CSP. (Note the frequency with which CSP bypasses are found.)


If an attacker can run javascript on the page, then you've already failed to prevent the attacker from getting code execution. CSP is mainly for preventing them from getting that far.


The CSP directive mentioned can stop some clickjacking/link spoofing in cases where JavaScript is disabled by the browser. There's other directives that address script vectors themselves.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.