45
votes
Accepted
What is meant by "Vulnerable with: css class selector" for JQuery?
In jQuery you can specify a CSS selector and HTML code with the same shorthand.
This is a selector:
$('#some-thing')
This is HTML that gets evaluated immediately:
$('<svg onload=alert(1)>')
...
- 45.1k
8
votes
Protecting against input type ="password" changes?
Well, you can do it using the MutationObserver API.
const inputPasswordElements = document.querySelectorAll('input[type=password]');
const observer = new MutationObserver(function (mutations) {
...
- 14.7k
7
votes
Accepted
XSS - arbitrary file in background-image css property
No, that's not possible.
A value to background-image will be rendered as an image. Even an SVG with embedded script code would just be displayed as an image when loaded via background-image. So XSS ...
- 45.1k
5
votes
Accepted
Can controlling the content of a CSS url property possibly be exploited in any major way?
Possibly. The response contains an URL inside CSS inside HTML. All three have different escaping regimes, and if the application's developer did not do escaping for one of these right, you might be ...
- 355
5
votes
How do I let users point to their own images, yet avoid Mixed Content warnings?
Would rewriting HTTP addresses as HTTPS work?
Only if the webserver hosting the images accepts https as well as http.
I would say the solution is to grab the images, and host a copy yourself, which ...
- 17.6k
5
votes
Accepted
Why should class names be whitelisted?
The problem is when user-specified HTML is included together with your own HTML and application logic on the same page. It is common that the application logic depends on the content or location of ...
- 208k
5
votes
Should javascript and css ".map" source maps be included on production servers?
Open Chrome dev tools on any site you know has a source map included, click sources tab and you will immediately see why including source maps on prod is a bad idea. You will get a tonne of ...
- 2,859
4
votes
Accepted
Is it dangerous to allow customers to refer to fonts.googleapis.com in their scripts?
In theory, you're fine loading stylesheets and fonts from a third party - as you say, they're included in link tags, which shouldn't allow script execution. There are a few things which might cause ...
- 27.4k
3
votes
Can Arbitrary Code Execution be done using CSS Injection?
If attacker replaces original CSS file with a malicious CSS file and if the web-server sends this malicious CSS file to the client, can the attacker execute some code in the client?
Executing client-...
- 1,336
3
votes
DRM on CSS or even HTML files through domain locking via Javascript?
You could do this a few ways, here's some I'd suggest:
Use a CSS Obfuscator
This won't prevent people from stealing your css, but it will make working on it difficult.
Build with JavaScript (& ...
- 169
2
votes
How dangerous is it to use CSS styles from an untrusted source?
In addition to allowing potential attacker to fake the user interface to look like something else (e.g. make new forum message form look like login form) there's a possibility of side-channel data ...
2
votes
Accepted
Cross site styling vulnerability?
If you are not the web site author/admin, and you can (as a site user) add a stylesheet to a page, then this could be an attack vector--though arguably not a full-blown vulnerability.
For example, ...
- 176
2
votes
Why doesn't CSP block JS from modifying an element's style?
You can use CSP to block specific sources of stylesheets, but not to disallow particular style attributes. For example, you can disallow inline styles, or disallow remote styles, or both. (If you ...
- 16.1k
2
votes
Accepted
XSS in custom, user-supplied CSS
This approach does not seem ideal since it is common to find bypasses when it comes to blacklists.
There are some great resources out there such as "Scriptless Attacks – Stealing the Pie Without ...
- 1,336
2
votes
Published URL File APP.CSS
It's a bit unusual to publish a CSS file which the minify process failed on, and may be indicative of other issues (e.g. insufficient monitoring of the deployment process), but CSS files are used by ...
- 27.4k
2
votes
Stealing page source via Clickjacking
Stealing information is not easily possible and not what Clickjacking is really about.
Clickjacking is functionally similar to CSRF, in that you can perform actions on the site across origins, but ...
- 29.8k
2
votes
Accepted
Is it true that frontend validation is generally redundant for minimalist contact forms on minimalist environments?
I would say that frontend and backend validation are not redundant because they serve different purposes:
Backend validation: enforcing the data format as it enters the application.
Frontend ...
- 59.3k
2
votes
SQL Lite Injection via CSS URL
tl;dr: I would expect this to be a false positive related to caching (which doesn't require a fix), not an SQLi. But it's definitely something to follow up on with the testers as well as the devs.
A ...
- 29.8k
2
votes
Accepted
Can XSS ever occur in an <img> tag's "src" attribute?
The HTML spec states that the src attribute must point to a valid image resource that is neither paged nor scripted.
The src attribute must be present, and must contain a valid non-empty URL ...
- 11.6k
1
vote
Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?
The best spec I know is W3C Editor's Draft SVG Integration which says e.g.
For SVG to adhere to the security model of the Web platform, certain
SVG features are required to be disabled depending on ...
1
vote
XSS Payloads: <script> vs javascript:
javascript: is the URI scheme (like http: or https: or ftp: or file:) for immediate-execution javascript. Javascript URIs can be set as the "URL" of a window, both the top-level window or an ...
- 52.3k
1
vote
Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?
You are assuming that distinguishing yourself from the others will only be done if Javascript is enabled. But, assuming that all but you have Javascript enabled , exactly disabling Javascript might ...
- 208k
1
vote
Accepted
Is there any way for a Content-Security-Policy to block a CSS function, (specifically the url() function)?
Content Security Policy provides only a way to restrict the target of a request based on the context of the target but not on the actual source of the target. Thus it is not possible to restrict ...
- 208k
1
vote
Accepted
What can a 3rd party learn about a user through only CSS and images?
This answer might be considered as a partial answer since it's not intended to be exhaustive.
With CSS only, a 3rd party can indeed (to a certain point) fingerprint a user's browser by:
CSS querying ...
- 2,677
1
vote
Site inaccessible with Cookies turned off in browser
My website is simple (a blog) HTML and CSS and I store nor ask for any data from the visitors.
Are you sure your site is only HTML+CSS? Your site wouldn't happen to be using some free hosting service ...
- 59.3k
1
vote
Why doesn't CSP block JS from modifying an element's style?
If an attacker can run javascript on the page, then you've already failed to prevent the attacker from getting code execution. CSP is mainly for preventing them from getting that far.
- 1,502
1
vote
Accepted
How to send remotely loadable CSS with an email as explained in ROPEMAKER whitepaper?
There are two ways of include resources inside an email HTML part: as links to external sites (i.e. <img src=http://example.com/... or <link rel=stylesheet href=http://example.com/...) or by ...
- 208k
1
vote
Is it dangerous to allow customers to refer to fonts.googleapis.com in their scripts?
Font files cannot contain client-side script.
You would however need to allow the locations within any Content Security Policy you will be using (font-src directive), therefore this will be ...
- 34.4k
Only top scored, non community-wiki answers of a minimum length are eligible