I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags.
I'm looking for advice / links on how inline styles could be abused.
Do Microsoft behaviours work for inline styles?
I know that the best solution to make this work would be to validate/sanitize the CSS against a whitelist - but this requires implementing a CSS parser and producing/maintaining a whitelist of properties. Would a blacklist of properties / patterns be feasible? (I'm aware of the relative merits of whitelisting/blacklisting - but it's somewhat skewed here in that there should only be a finite number of attack vectors).
Just to clarify, since the content editors should to some extent be trusted, mitigation of attacks might be a more pragmatic solution than prevention.
Also, just found a specific example in CVE-2011-0232, although I'm more interested in cases where there is not an intrinsic vulnerability in an implementation, but rather a design flaw.