2022 Developer Survey is open! Take survey.

Questions tagged [css]

Cascading Style Sheets (CSS) is a language used to describe the presentation of markup documents, usually written in HTML.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
9 views

Is it possible to enforce CSS1 in browsers? [migrated]

I was recently surprised to learn that CSS2+ is Turing complete, and hence it is potentially dangerous, from the information security standpoint, to open websites containing CSS. That being said, if a ...
user avatar
0 votes
0 answers
20 views

Load url from CSS applied to element outside DOM

I was wondering if it's possible to kick off a network call by manipulating the style tag on an element outside the DOM (which could lead to potential SSRF if this were done server-side). I've tried a ...
user avatar
  • 349
2 votes
1 answer
290 views

Can XSS ever occur in an <img> tag's "src" attribute?

In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following: <img src="javascript:alert(1)...
user avatar
  • 123
7 votes
1 answer
265 views

Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?

We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
user avatar
0 votes
1 answer
182 views

XSS Payloads: <script> vs javascript:

Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for javascript:alert(0) The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML. <...
user avatar
0 votes
1 answer
170 views

Is it true that frontend validation is generally redundant for minimalist contact forms on minimalist environments?

Say I have a continuously upgraded and well maintained LAMP environment with a website which its CMS is all-core and continuously upgraded as well and I have created a simple backend HTML contact form ...
user avatar
0 votes
1 answer
121 views

Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?

I have Tor Browser (which is basically Firefox ESR) on "Safest" setting (Javascript disabled). We're generally scolded about using extensions in it, as they can alter web traffic patterns to ...
user avatar
  • 101
1 vote
1 answer
91 views

Is there any way for a Content-Security-Policy to block a CSS function, (specifically the url() function)?

I would like to block the execution of any instance of CSS's url() function in CSS provided by my server. One promising method would be a CSP, but I'm not sure if this is possible using a CSP. Is it? ...
user avatar
  • 188
0 votes
1 answer
198 views

XSS and Content Security Policy, and existing CSS

I have done the first development of a website and deployment. Scanning the server with an online security evaluation tool I was recommended that I add a Content security Policy to the website, and I ...
user avatar
  • 3
5 votes
1 answer
1k views

What's the security risk of using a protocol-relative URL in a CSS stylesheet?

I used SonarQube to perform a static code analysis of my project and it detected a security vulnerability in one of my CSS files: For security reasons, protocol-relative URLs should not be used. ...
user avatar
1 vote
2 answers
209 views

What can a 3rd party learn about a user through only CSS and images?

In its default settings, uMatrix content blocker allows CSS and images (JPG, PNG, etc) from all sources, unless denied by a site-specific block list. It also allows 1st party cookies, scripts, and ...
user avatar
  • 367
0 votes
1 answer
183 views

Published URL File APP.CSS

I am crossing an analysis on a website and while fuzzing and testing I came across the below URL: https//www.****.**.*/content/css/app.css Which generated the below output: /* Minification failed. ...
user avatar
  • 13
1 vote
1 answer
276 views

Stealing page source via Clickjacking [closed]

I am learning Javascript. Also researching web based vulnerabilitys to learn. I just wondering how Javascript can be used to steal view page source or any text or any tokens leaking on the page via ...
user avatar
1 vote
0 answers
249 views

CSS Injection without colon

I'm looking for a way to create a CSS injection proof-of-concept. I can insert the following and it gets reflected in the browser: <style>body{background-color:red}</style> The only ...
user avatar
3 votes
1 answer
563 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
user avatar
  • 141
1 vote
1 answer
86 views

Site inaccessible with Cookies turned off in browser [closed]

Whenever I access my website with cookies turned off in browser, it redirects me to a google support page that informs me to allow cookies. My website is simple (a blog) HTML and CSS and I store nor ...
user avatar
1 vote
1 answer
285 views

XSS in custom, user-supplied CSS

Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to ...
user avatar
  • 145
2 votes
0 answers
757 views

What are the dangers of "style-src: 'unsafe-inline'"? [duplicate]

This is a common sight in content security policies: style-src 'unsafe-inline' I know that this "UI redressing attacks" that can be use for phishing or just defamation. But are there other threats ...
user avatar
  • 64.2k
2 votes
2 answers
167 views

How do I let users point to their own images, yet avoid Mixed Content warnings?

I allow users of my webapp to provide a URL for their own images. They can also provide CSS which may contain URLs to images. If these URLs are HTTP then the browser does not show the padlock in the ...
user avatar
-5 votes
1 answer
2k views

Protecting against input type ="password" changes? [closed]

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password? There are probably ...
user avatar
2 votes
2 answers
1k views

Can controlling the content of a CSS url property possibly be exploited in any major way?

So I noticed on a site I'm penetration testing that when you save your profile settings after changing them, one of the parameters in the POST request is avatar_url. I realized that I could repeat ...
user avatar
  • 461
6 votes
2 answers
4k views

XSS - arbitrary file in background-image css property

Is it possible to make an XSS attack if you can inject an arbitrary file (any extension, like: .js, .html etc...) in background-image CSS property? If yes, how to do it?
user avatar
  • 63
0 votes
3 answers
338 views

Why doesn't CSP block JS from modifying an element's style?

You can use Content Security Policy to disallow style attributes, but you can just get around this just by using javascript to modify an element's style. Isn't this a security hole or am I missing ...
user avatar
27 votes
1 answer
5k views

What is meant by "Vulnerable with: css class selector" for JQuery?

I'm mostly a beginner in cybersecurity. I came across this the other day about how JQuery 1.3.2 is vulnerable to CSS Selectors and Location Hash (source). I understand how XSS works and I know what ...
user avatar
  • 403
5 votes
1 answer
184 views

Why should class names be whitelisted?

I am using the Accept known good validation strategy to sanitize user input (rich HTML) and are using a 3rd party component to do this. The component by default requires every permitted class name to ...
user avatar
0 votes
1 answer
144 views

How to send remotely loadable CSS with an email as explained in ROPEMAKER whitepaper?

I have been reading the ROPEMAKER exploit whitepaper by Mimecast. In the article they are mentioning of sending a safe HTML(which may contain evil text, but as long as it is a plain HTML its safe with ...
user avatar
1 vote
1 answer
992 views

Cross site styling vulnerability? [duplicate]

I stumbled across a "vulnerability" that allows me to include an arbitrary css stylesheet in a website. I understand that this is potentially a tool for csrf or stealing url parameters. But on its ...
user avatar
-1 votes
2 answers
564 views

DRM on CSS or even HTML files through domain locking via Javascript?

If you are planning to downvote me to oblivion, let me clarify what this question is about: I am not interested to prevent someone from copying my website. I know there are no foolproof method. My ...
user avatar
  • 125
0 votes
2 answers
465 views

Is it dangerous to allow customers to refer to fonts.googleapis.com in their scripts?

We are hosting customer created scripts (xlst). I am wondering if it would affect the security of our application if we allow customers to refer to fonts hosted at e.g. fonts.googleapis.com? Since ...
user avatar
  • 103
-4 votes
1 answer
221 views

Effective methods of preventing people ripping HTML/CSS/JS off my site via right click “save-as”? [duplicate]

PS: My last question was marked duplicated incorrectly. For all those marking this as a duplicate of the image copying question posted earlier, I am not interested in preventing just image copying. I ...
user avatar
  • 125
2 votes
1 answer
108 views

Security Implications of PHPCSS Files ( Dynamic CSS using PHP )

I'm working on an website where I need to allow the user to change multiple CSS values in their CMS. I need to read these values back to the browser in CSS and ran across an "easy" way to do just that ...
user avatar
-1 votes
1 answer
374 views

Security measures needed to use code snippets of HTML, CSS, JavaScript and PHP on website

So obviously you would do html_entities() with the ENT_QUOTES flag right before it is being outputted, but I still have a feel that other languages like JavaScript and PHP are not taken care of. What ...
user avatar
  • 101
5 votes
1 answer
4k views

Browser exploits based purely on HTML + CSS

In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3. This led some to say that the combination of HTML + CSS3 is Turing complete. Regardless of whether HTML + CSS3 is technically ...
user avatar
3 votes
3 answers
309 views

CSS code can be seen through my browser. Is that a vulnerability?

I have a WordPress blog, and when I navigate to a particular path such as http://example.com/wp-content/themes/css/jquery-scrollbar.css?, I could see all the CSS code for the scroll bar. My questions ...
user avatar
  • 97
11 votes
1 answer
6k views

Should javascript and css ".map" source maps be included on production servers?

Source maps are a convenient way to work with directly with code that has been obfuscated and/or minified, yet trace errors back to the original "pretty" code. My understanding is that obfuscating ...
user avatar
  • 607
9 votes
2 answers
112 views

Personal stylesheets

In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets. He brings up a scenario in which a dev might use ...
user avatar
  • 191
0 votes
1 answer
5k views

Techniques for accessing hidden content on a web page [closed]

If content is hidden on a web page using a CSS hidden directive (consider this example of hiding the Sharepoint 2013 Share button with CSS). What techniques allow the user to circumvent that and ...
user avatar
  • 101
22 votes
2 answers
2k views

Does this CSS code expose if a message is read, and how long they have been reading it?

This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted. They also claim it works in pretty ...
user avatar
2 votes
0 answers
151 views

Is it dangerous to allow users to edit the CSS styles? [duplicate]

I'm working on a blog site, and I plan to allow bloggers to completely edit the style sheet for their own blogs I assume this isn't dangerous, since CSS is client side, but I thought it'd be best to ...
user avatar
  • 21
1 vote
3 answers
289 views

Is a normal user allowed to view site's CSS sheet

I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file. Is ...
user avatar
5 votes
3 answers
3k views

CAPTCHAs: How does simple math in cleartext prove you're human?

I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is ...
user avatar
  • 53
8 votes
3 answers
8k views

Can CSS file contain malware? [duplicate]

I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
user avatar
-3 votes
1 answer
187 views

Feedback Form Exploitation possible or not? [closed]

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
user avatar
1 vote
2 answers
618 views

Identify users accessing hidden link in a website

Recently I put some hidden links in a web site in order to trap web crawlers. (Used CSS visibility hidden style in order to avoid human users accessing it). Any way, I found that there were plenty of ...
user avatar
4 votes
1 answer
6k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
user avatar
  • 151
4 votes
2 answers
1k views

To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
user avatar
38 votes
1 answer
5k views

CSS based attacks

I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags. I'm looking for advice / links on how inline styles could be abused. Part of the reason ...
user avatar
  • 18.3k
23 votes
3 answers
6k views

How dangerous is it to use CSS styles from an untrusted source?

I'm a moderator at a forum. We want to have a new style for the forum. We're thinking about announcing a competition to the users to come up with the best CSS design; we would adopt the best ...
user avatar
  • 1,188