Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to improve it. Basically, if the CSS contains some of these...
"expression",
"@import",
"@charset",
"javascript",
"url(",
"behavior",
"data:",
"http:",
"https:",
"//",
"vbscript",
"moz-binding",
"\\" //just one backslash (this one is escaped)
...the app declines it and asks user not to use any of these. I also want to prevent them from inserting remote objects and stuff via data-URIs.
Would this be sufficient? Is it good approach or should I consider other options?