1

Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to improve it. Basically, if the CSS contains some of these...

    "expression",
    "@import",
    "@charset",
    "javascript",
    "url(",
    "behavior",
    "data:",
    "http:",
    "https:",
    "//",
    "vbscript",
    "moz-binding",
    "\\"           //just one backslash (this one is escaped)

...the app declines it and asks user not to use any of these. I also want to prevent them from inserting remote objects and stuff via data-URIs.

Would this be sufficient? Is it good approach or should I consider other options?

Improve this question
3

1 Answer 1

Reset to default
2

This approach does not seem ideal since it is common to find bypasses when it comes to blacklists.

There are some great resources out there such as "Scriptless Attacks – Stealing the Pie Without Touching the Sill" and LiveOverflow's recent video "The Curse of Cross-Origin Stylesheets" if you are interested in learning more on scriptless attacks that rely on CSS. These links might give you a better idea of what issues might arise as a result of user-supplied CSS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .