Questions tagged [css]
Cascading Style Sheets (CSS) is a language used to describe the presentation of markup documents, usually written in HTML.
40
questions
4
votes
1answer
68 views
What's the security risk of using a protocol-relative URL in a CSS stylesheet?
I used SonarQube to perform a static code analysis of my project and it detected a security vulnerability in one of my CSS files:
For security reasons, protocol-relative URLs should not be used.
...
0
votes
0answers
95 views
CSS injection: Extract CSRF-token by using inline-css injection
Is it possible to extract CSRF-token by using inline-CSS injection (inside style attribute)? (It seems to be impossible, because it is not possible to define CSS classes inside attributes.)
<p ...
1
vote
2answers
133 views
What can a 3rd party learn about a user through only CSS and images?
In its default settings, uMatrix content blocker allows CSS and images (JPG, PNG, etc) from all sources, unless denied by a site-specific block list. It also allows 1st party cookies, scripts, and ...
0
votes
1answer
77 views
Published URL File APP.CSS
I am crossing an analysis on a website and while fuzzing and testing I came across the below URL:
https//www.****.**.*/content/css/app.css
Which generated the below output:
/* Minification failed. ...
1
vote
1answer
73 views
Stealing page source via Clickjacking [closed]
I am learning Javascript. Also researching web based vulnerabilitys to learn. I just wondering how Javascript can be used to steal view page source or any text or any tokens leaking on the page via ...
1
vote
0answers
144 views
CSS Injection without colon
I'm looking for a way to create a CSS injection proof-of-concept. I can insert the following and it gets reflected in the browser:
<style>body{background-color:red}</style>
The only ...
2
votes
1answer
165 views
Can Arbitrary Code Execution be done using CSS Injection?
As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
1
vote
1answer
44 views
Site inaccessible with Cookies turned off in browser [closed]
Whenever I access my website with cookies turned off in browser, it redirects me to a google support page that informs me to allow cookies. My website is simple (a blog) HTML and CSS and I store nor ...
1
vote
1answer
130 views
XSS in custom, user-supplied CSS
Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to ...
2
votes
0answers
269 views
What are the dangers of “style-src: 'unsafe-inline'”? [duplicate]
This is a common sight in content security policies:
style-src 'unsafe-inline'
I know that this "UI redressing attacks" that can be use for phishing or just defamation. But are there other threats ...
2
votes
1answer
94 views
How do I let users point to their own images, yet avoid Mixed Content warnings?
I allow users of my webapp to provide a URL for their own images. They can also provide CSS which may contain URLs to images.
If these URLs are HTTP then the browser does not show the padlock in the ...
-6
votes
1answer
1k views
Protecting against input type =“password” changes? [closed]
Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password?
There are probably ...
1
vote
2answers
423 views
Can controlling the content of a CSS url property possibly be exploited in any major way?
So I noticed on a site I'm penetration testing that when you save your profile settings after changing them, one of the parameters in the POST request is avatar_url.
I realized that I could repeat ...
5
votes
2answers
2k views
XSS - arbitrary file in background-image css property
Is it possible to make an XSS attack if you can inject an arbitrary file (any extension, like: .js, .html etc...) in background-image CSS property? If yes, how to do it?
0
votes
3answers
187 views
Why doesn't CSP block JS from modifying an element's style?
You can use Content Security Policy to disallow style attributes, but you can just get around this just by using javascript to modify an element's style. Isn't this a security hole or am I missing ...
26
votes
1answer
4k views
What is meant by “Vulnerable with: css class selector” for JQuery?
I'm mostly a beginner in cybersecurity. I came across this the other day about how JQuery 1.3.2 is vulnerable to CSS Selectors and Location Hash (source).
I understand how XSS works and I know what ...
3
votes
1answer
113 views
Why should class names be whitelisted?
I am using the Accept known good validation strategy to sanitize user input (rich HTML) and are using a 3rd party component to do this.
The component by default requires every permitted class name to ...
0
votes
1answer
92 views
How to send remotely loadable CSS with an email as explained in ROPEMAKER whitepaper?
I have been reading the ROPEMAKER exploit whitepaper by Mimecast. In the article they are mentioning of sending a safe HTML(which may contain evil text, but as long as it is a plain HTML its safe with ...
1
vote
1answer
482 views
Cross site styling vulnerability? [duplicate]
I stumbled across a "vulnerability" that allows me to include an arbitrary css stylesheet in a website.
I understand that this is potentially a tool for csrf or stealing url parameters. But on its ...
-1
votes
2answers
358 views
DRM on CSS or even HTML files through domain locking via Javascript?
If you are planning to downvote me to oblivion, let me clarify what this question is about:
I am not interested to prevent someone from copying my website. I know there are no foolproof method.
My ...
0
votes
2answers
178 views
Is it dangerous to allow customers to refer to fonts.googleapis.com in their scripts?
We are hosting customer created scripts (xlst). I am wondering if it would affect the security of our application if we allow customers to refer to fonts hosted at e.g. fonts.googleapis.com? Since ...
-4
votes
1answer
159 views
Effective methods of preventing people ripping HTML/CSS/JS off my site via right click “save-as”? [duplicate]
PS: My last question was marked duplicated incorrectly. For all those marking this as a duplicate of the image copying question posted earlier, I am not interested in preventing just image copying. I ...
2
votes
1answer
66 views
Security Implications of PHPCSS Files ( Dynamic CSS using PHP )
I'm working on an website where I need to allow the user to change multiple CSS values in their CMS. I need to read these values back to the browser in CSS and ran across an "easy" way to do just that ...
-1
votes
1answer
303 views
Security measures needed to use code snippets of HTML, CSS, JavaScript and PHP on website
So obviously you would do html_entities() with the ENT_QUOTES flag right before it is being outputted, but I still have a feel that other languages like JavaScript and PHP are not taken care of. What ...
3
votes
1answer
3k views
Browser exploits based purely on HTML + CSS
In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3.
This led some to say that the combination of HTML + CSS3 is Turing complete.
Regardless of whether HTML + CSS3 is technically ...
2
votes
3answers
256 views
CSS code can be seen through my browser. Is that a vulnerability?
I have a WordPress blog, and when I navigate to a particular path such as http://example.com/wp-content/themes/css/jquery-scrollbar.css?, I could see all the CSS code for the scroll bar.
My questions ...
10
votes
1answer
4k views
Should javascript and css “.map” source maps be included on production servers?
Source maps are a convenient way to work with directly with code that has been obfuscated and/or minified, yet trace errors back to the original "pretty" code.
My understanding is that obfuscating ...
9
votes
2answers
72 views
Personal stylesheets
In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets.
He brings up a scenario in which a dev might use ...
0
votes
1answer
2k views
Techniques for accessing hidden content on a web page [closed]
If content is hidden on a web page using a CSS hidden directive (consider this example of hiding the Sharepoint 2013 Share button with CSS).
What techniques allow the user to circumvent that and ...
22
votes
2answers
2k views
Does this CSS code expose if a message is read, and how long they have been reading it?
This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted.
They also claim it works in pretty ...
2
votes
0answers
63 views
Is it dangerous to allow users to edit the CSS styles? [duplicate]
I'm working on a blog site, and I plan to allow bloggers to completely edit the style sheet for their own blogs
I assume this isn't dangerous, since CSS is client side, but I thought it'd be best to ...
1
vote
3answers
245 views
Is a normal user allowed to view site's CSS sheet
I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file.
Is ...
2
votes
2answers
1k views
CAPTCHAs: How does simple math in cleartext prove you're human?
I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is ...
6
votes
3answers
6k views
Can CSS file contain malware? [duplicate]
I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
-3
votes
1answer
126 views
Feedback Form Exploitation possible or not? [closed]
how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
1
vote
2answers
504 views
Identify users accessing hidden link in a website
Recently I put some hidden links in a web site in order to trap web crawlers. (Used CSS visibility hidden style in order to avoid human users accessing it).
Any way, I found that there were plenty of ...
4
votes
1answer
5k views
Calling JavaScript functions from within a Style tag XSS
I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on.
...
4
votes
2answers
685 views
To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?
I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
34
votes
1answer
4k views
CSS based attacks
I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags.
I'm looking for advice / links on how inline styles could be abused.
Part of the reason ...
16
votes
3answers
4k views
How dangerous is it to use CSS styles from an untrusted source?
I'm a moderator at a forum. We want to have a new style for the forum.
We're thinking about announcing a competition to the users to come up with the best CSS design; we would adopt the best ...
