Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm wondering if I'm risking anything if I use
style-src-attr 'unsafe-hashes' <hash>
in my CSP header.
I need to allow an external script to run, and it uses the style attribute on some elements.
I have no control over the external script, and if there is a malicious person behind it, what might an attack vector be? (considering unsafe-inline has not been added)
How can a style attribute execute scripts or access my DOM or otherwise cause anything harmful to happen?
CSS can dramatically alter the way a page looks and even add content to the page. It's possible to hide content, such as privacy or security notices; show content, such as phishing information; or alter content, such as by forcing elements to the foreground or background. You could also use it to insert hidden or nearly hidden content to try to game search engine rankings, or to make the page into a totally different looking page.
If you're using unsafe-hashes, then you've by definition hashed the content and know what's in it. If it's just doing something innocuous like adjusting the list type marker or setting a relative font size, then it's probably fine. If the page is doing something more questionable, you have to decide what the tradeoffs are.
You may wish to think about what the consequences would be if the script added that style to many elements, nested elements, or unexpected elements. If you're pretty sure that the only consequence is making the page look ugly or unreadable, then the risk is low; users will alert to you cases where your page looks hideous.
I'm wondering if I'm risking anything if I use
style-src-attr 'unsafe-hashes' <hash>in my CSP header.
Really you have only one "risk" here - after changing content of style='...' you need to recalc hashes operatively. Otherwise styles will not apply and external wdget will not look propertly or work at all. And external widgets can correct their styles any moment.
I need to allow an external script to run, and it uses the style attribute on some elements.
I have no control over the external script, and if there is a malicious person behind it, what might an attack vector be? (considering unsafe-inline has not been added)
If you have third party script running, the "style attrubutes" is a last thing you need to worry about. Moreover, script can change/add style attributes in absence of 'unsafe-inline' in style-src.
Third-party script can do a lot, for example, redirect all traffic to another site or inject Ads.
His possibilities to harm restrict by others CSP directives, but not the style-src.
How can a style attribute execute scripts or access my DOM or otherwise cause anything harmful to happen?
There is no way to execute script over style attribute.
Yes, by change style attribute your page could look diffrerent way, but it need a script to do that. Therefore ref to para above.
Really by using styles without scripting is possible a few CSSAR (CSS Attribute Reading) attacks of reading tag attributes with CSS selectors, but it need to have wide open img-src.
IMHO the danger of 'unsafe-inline' in styles is greatly exaggerated, and when third-party scripts are connected, you don't even need to worry about styles.
PS: Styles is a low risk vector of attack, that is why CSP3 spec provides unsafe-eval even for styles, but that was never implemented in any browser.
It need to avoid 'unsafe-inline' in styles only on pages where your app work with bank cards.
