Questions tagged [css]
Cascading Style Sheets (CSS) is a language used to describe the presentation of markup documents, usually written in HTML.
48
questions
-1
votes
0
answers
9
views
Is it possible to enforce CSS1 in browsers? [migrated]
I was recently surprised to learn that CSS2+ is Turing complete, and hence it is potentially dangerous, from the information security standpoint, to open websites containing CSS. That being said, if a ...
- 99
0
votes
0
answers
20
views
Load url from CSS applied to element outside DOM
I was wondering if it's possible to kick off a network call by manipulating the style tag on an element outside the DOM (which could lead to potential SSRF if this were done server-side). I've tried a ...
- 349
2
votes
1
answer
290
views
Can XSS ever occur in an <img> tag's "src" attribute?
In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following:
<img src="javascript:alert(1)...
- 123
7
votes
1
answer
265
views
Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?
We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
0
votes
1
answer
182
views
XSS Payloads: <script> vs javascript:
Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for
javascript:alert(0)
The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML.
<...
0
votes
1
answer
170
views
Is it true that frontend validation is generally redundant for minimalist contact forms on minimalist environments?
Say I have a continuously upgraded and well maintained LAMP environment with a website which its CMS is all-core and continuously upgraded as well and I have created a simple backend HTML contact form ...
0
votes
1
answer
121
views
Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?
I have Tor Browser (which is basically Firefox ESR) on "Safest" setting (Javascript disabled). We're generally scolded about using extensions in it, as they can alter web traffic patterns to ...
- 101
1
vote
1
answer
91
views
Is there any way for a Content-Security-Policy to block a CSS function, (specifically the url() function)?
I would like to block the execution of any instance of CSS's url() function in CSS provided by my server. One promising method would be a CSP, but I'm not sure if this is possible using a CSP. Is it? ...
- 188
0
votes
1
answer
198
views
XSS and Content Security Policy, and existing CSS
I have done the first development of a website and deployment. Scanning the server with an online security evaluation tool I was recommended that I add a Content security Policy to the website, and I ...
- 3
5
votes
1
answer
1k
views
What's the security risk of using a protocol-relative URL in a CSS stylesheet?
I used SonarQube to perform a static code analysis of my project and it detected a security vulnerability in one of my CSS files:
For security reasons, protocol-relative URLs should not be used.
...
- 13.9k
1
vote
2
answers
209
views
What can a 3rd party learn about a user through only CSS and images?
In its default settings, uMatrix content blocker allows CSS and images (JPG, PNG, etc) from all sources, unless denied by a site-specific block list. It also allows 1st party cookies, scripts, and ...
- 367
0
votes
1
answer
183
views
Published URL File APP.CSS
I am crossing an analysis on a website and while fuzzing and testing I came across the below URL:
https//www.****.**.*/content/css/app.css
Which generated the below output:
/* Minification failed. ...
- 13
1
vote
1
answer
276
views
Stealing page source via Clickjacking [closed]
I am learning Javascript. Also researching web based vulnerabilitys to learn. I just wondering how Javascript can be used to steal view page source or any text or any tokens leaking on the page via ...
- 11
1
vote
0
answers
249
views
CSS Injection without colon
I'm looking for a way to create a CSS injection proof-of-concept. I can insert the following and it gets reflected in the browser:
<style>body{background-color:red}</style>
The only ...
- 11
3
votes
1
answer
563
views
Can Arbitrary Code Execution be done using CSS Injection?
As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
- 141
1
vote
1
answer
86
views
Site inaccessible with Cookies turned off in browser [closed]
Whenever I access my website with cookies turned off in browser, it redirects me to a google support page that informs me to allow cookies. My website is simple (a blog) HTML and CSS and I store nor ...
- 11
1
vote
1
answer
285
views
XSS in custom, user-supplied CSS
Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to ...
- 145
2
votes
0
answers
757
views
What are the dangers of "style-src: 'unsafe-inline'"? [duplicate]
This is a common sight in content security policies:
style-src 'unsafe-inline'
I know that this "UI redressing attacks" that can be use for phishing or just defamation. But are there other threats ...
- 64.2k
2
votes
2
answers
167
views
How do I let users point to their own images, yet avoid Mixed Content warnings?
I allow users of my webapp to provide a URL for their own images. They can also provide CSS which may contain URLs to images.
If these URLs are HTTP then the browser does not show the padlock in the ...
- 229
-5
votes
1
answer
2k
views
Protecting against input type ="password" changes? [closed]
Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password?
There are probably ...
- 379
2
votes
2
answers
1k
views
Can controlling the content of a CSS url property possibly be exploited in any major way?
So I noticed on a site I'm penetration testing that when you save your profile settings after changing them, one of the parameters in the POST request is avatar_url.
I realized that I could repeat ...
- 461
6
votes
2
answers
4k
views
XSS - arbitrary file in background-image css property
Is it possible to make an XSS attack if you can inject an arbitrary file (any extension, like: .js, .html etc...) in background-image CSS property? If yes, how to do it?
- 63
0
votes
3
answers
338
views
Why doesn't CSP block JS from modifying an element's style?
You can use Content Security Policy to disallow style attributes, but you can just get around this just by using javascript to modify an element's style. Isn't this a security hole or am I missing ...
- 119
27
votes
1
answer
5k
views
What is meant by "Vulnerable with: css class selector" for JQuery?
I'm mostly a beginner in cybersecurity. I came across this the other day about how JQuery 1.3.2 is vulnerable to CSS Selectors and Location Hash (source).
I understand how XSS works and I know what ...
- 403
5
votes
1
answer
184
views
Why should class names be whitelisted?
I am using the Accept known good validation strategy to sanitize user input (rich HTML) and are using a 3rd party component to do this.
The component by default requires every permitted class name to ...
- 734
0
votes
1
answer
144
views
How to send remotely loadable CSS with an email as explained in ROPEMAKER whitepaper?
I have been reading the ROPEMAKER exploit whitepaper by Mimecast. In the article they are mentioning of sending a safe HTML(which may contain evil text, but as long as it is a plain HTML its safe with ...
- 1,382
1
vote
1
answer
992
views
Cross site styling vulnerability? [duplicate]
I stumbled across a "vulnerability" that allows me to include an arbitrary css stylesheet in a website.
I understand that this is potentially a tool for csrf or stealing url parameters. But on its ...
- 320
-1
votes
2
answers
564
views
DRM on CSS or even HTML files through domain locking via Javascript?
If you are planning to downvote me to oblivion, let me clarify what this question is about:
I am not interested to prevent someone from copying my website. I know there are no foolproof method.
My ...
- 125
0
votes
2
answers
465
views
Is it dangerous to allow customers to refer to fonts.googleapis.com in their scripts?
We are hosting customer created scripts (xlst). I am wondering if it would affect the security of our application if we allow customers to refer to fonts hosted at e.g. fonts.googleapis.com? Since ...
- 103
-4
votes
1
answer
221
views
Effective methods of preventing people ripping HTML/CSS/JS off my site via right click “save-as”? [duplicate]
PS: My last question was marked duplicated incorrectly. For all those marking this as a duplicate of the image copying question posted earlier, I am not interested in preventing just image copying. I ...
- 125
2
votes
1
answer
108
views
Security Implications of PHPCSS Files ( Dynamic CSS using PHP )
I'm working on an website where I need to allow the user to change multiple CSS values in their CMS. I need to read these values back to the browser in CSS and ran across an "easy" way to do just that ...
- 240
-1
votes
1
answer
374
views
Security measures needed to use code snippets of HTML, CSS, JavaScript and PHP on website
So obviously you would do html_entities() with the ENT_QUOTES flag right before it is being outputted, but I still have a feel that other languages like JavaScript and PHP are not taken care of. What ...
- 101
5
votes
1
answer
4k
views
Browser exploits based purely on HTML + CSS
In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3.
This led some to say that the combination of HTML + CSS3 is Turing complete.
Regardless of whether HTML + CSS3 is technically ...
- 1,961
3
votes
3
answers
309
views
CSS code can be seen through my browser. Is that a vulnerability?
I have a WordPress blog, and when I navigate to a particular path such as http://example.com/wp-content/themes/css/jquery-scrollbar.css?, I could see all the CSS code for the scroll bar.
My questions ...
- 97
11
votes
1
answer
6k
views
Should javascript and css ".map" source maps be included on production servers?
Source maps are a convenient way to work with directly with code that has been obfuscated and/or minified, yet trace errors back to the original "pretty" code.
My understanding is that obfuscating ...
- 607
9
votes
2
answers
112
views
Personal stylesheets
In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets.
He brings up a scenario in which a dev might use ...
- 191
0
votes
1
answer
5k
views
Techniques for accessing hidden content on a web page [closed]
If content is hidden on a web page using a CSS hidden directive (consider this example of hiding the Sharepoint 2013 Share button with CSS).
What techniques allow the user to circumvent that and ...
- 101
22
votes
2
answers
2k
views
Does this CSS code expose if a message is read, and how long they have been reading it?
This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted.
They also claim it works in pretty ...
- 403
2
votes
0
answers
151
views
Is it dangerous to allow users to edit the CSS styles? [duplicate]
I'm working on a blog site, and I plan to allow bloggers to completely edit the style sheet for their own blogs
I assume this isn't dangerous, since CSS is client side, but I thought it'd be best to ...
- 21
1
vote
3
answers
289
views
Is a normal user allowed to view site's CSS sheet
I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file.
Is ...
5
votes
3
answers
3k
views
CAPTCHAs: How does simple math in cleartext prove you're human?
I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is ...
- 53
8
votes
3
answers
8k
views
Can CSS file contain malware? [duplicate]
I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
- 467
-3
votes
1
answer
187
views
Feedback Form Exploitation possible or not? [closed]
how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
1
vote
2
answers
618
views
Identify users accessing hidden link in a website
Recently I put some hidden links in a web site in order to trap web crawlers. (Used CSS visibility hidden style in order to avoid human users accessing it).
Any way, I found that there were plenty of ...
- 113
4
votes
1
answer
6k
views
Calling JavaScript functions from within a Style tag XSS
I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on.
...
- 151
4
votes
2
answers
1k
views
To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?
I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
gate_engineer
38
votes
1
answer
5k
views
CSS based attacks
I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags.
I'm looking for advice / links on how inline styles could be abused.
Part of the reason ...
- 18.3k
23
votes
3
answers
6k
views
How dangerous is it to use CSS styles from an untrusted source?
I'm a moderator at a forum. We want to have a new style for the forum.
We're thinking about announcing a competition to the users to come up with the best CSS design; we would adopt the best ...
- 1,188