45 votes
Accepted

What is meant by "Vulnerable with: css class selector" for JQuery?

In jQuery you can specify a CSS selector and HTML code with the same shorthand. This is a selector: $('#some-thing') This is HTML that gets evaluated immediately: $('<svg onload=alert(1)>') ...
Arminius's user avatar
  • 44.8k
13 votes

CSS code can be seen through my browser. Is that a vulnerability?

Everything that is executed in the browser can be seen by the client, that is the nature of the Web. This includes HTML, javascript, and CSS. So, unless you put something confidential in a file that ...
Neil Smithline's user avatar
9 votes
Accepted

Browser exploits based purely on HTML + CSS

Yes, in the past there have been lots of exploits that only relied on malicious HTML and CSS code. You are right in that parsing a complex, turing-complete language is potentially more error-prone, ...
Arminius's user avatar
  • 44.8k
9 votes

Protecting against input type ="password" changes?

Well, you can do it using the MutationObserver API. const inputPasswordElements = document.querySelectorAll('input[type=password]'); const observer = new MutationObserver(function (mutations) { ...
Benoit Esnard's user avatar
7 votes
Accepted

XSS - arbitrary file in background-image css property

No, that's not possible. A value to background-image will be rendered as an image. Even an SVG with embedded script code would just be displayed as an image when loaded via background-image. So XSS ...
Arminius's user avatar
  • 44.8k
5 votes

How do I let users point to their own images, yet avoid Mixed Content warnings?

Would rewriting HTTP addresses as HTTPS work? Only if the webserver hosting the images accepts https as well as http. I would say the solution is to grab the images, and host a copy yourself, which ...
vidarlo's user avatar
  • 16.1k
5 votes
Accepted

Can controlling the content of a CSS url property possibly be exploited in any major way?

Possibly. The response contains an URL inside CSS inside HTML. All three have different escaping regimes, and if the application's developer did not do escaping for one of these right, you might be ...
dig's user avatar
  • 355
5 votes
Accepted

Why should class names be whitelisted?

The problem is when user-specified HTML is included together with your own HTML and application logic on the same page. It is common that the application logic depends on the content or location of ...
Steffen Ullrich's user avatar
5 votes

CSS code can be seen through my browser. Is that a vulnerability?

Welcome to Security.SE. The issue that you described is not a security vulnerability. The reason is that JavaScript and CSS files must be viewable by the browser so that your website can function ...
h4ckNinja's user avatar
  • 3,056
5 votes

Should javascript and css ".map" source maps be included on production servers?

Open Chrome dev tools on any site you know has a source map included, click sources tab and you will immediately see why including source maps on prod is a bad idea. You will get a tonne of ...
TrickyDupes's user avatar
  • 2,849
4 votes
Accepted

Is it dangerous to allow customers to refer to fonts.googleapis.com in their scripts?

In theory, you're fine loading stylesheets and fonts from a third party - as you say, they're included in link tags, which shouldn't allow script execution. There are a few things which might cause ...
Matthew's user avatar
  • 27.3k
3 votes

Can Arbitrary Code Execution be done using CSS Injection?

If attacker replaces original CSS file with a malicious CSS file and if the web-server sends this malicious CSS file to the client, can the attacker execute some code in the client? Executing client-...
EdOverflow's user avatar
  • 1,306
3 votes

DRM on CSS or even HTML files through domain locking via Javascript?

You could do this a few ways, here's some I'd suggest: Use a CSS Obfuscator This won't prevent people from stealing your css, but it will make working on it difficult. Build with JavaScript (& ...
admcfajn's user avatar
  • 169
2 votes

Security Implications of PHPCSS Files ( Dynamic CSS using PHP )

I have been doing exactly this for many years on several websites. This is no more and no less secure than using PHP to build an HTML page. Make sure you sanitize/validate any user-provided inputs (...
Moshe Katz's user avatar
  • 1,360
2 votes

Why doesn't CSP block JS from modifying an element's style?

You can use CSP to block specific sources of stylesheets, but not to disallow particular style attributes. For example, you can disallow inline styles, or disallow remote styles, or both. (If you ...
David's user avatar
  • 16.1k
2 votes
Accepted

Cross site styling vulnerability?

If you are not the web site author/admin, and you can (as a site user) add a stylesheet to a page, then this could be an attack vector--though arguably not a full-blown vulnerability. For example, ...
brirus's user avatar
  • 176
2 votes

Published URL File APP.CSS

It's a bit unusual to publish a CSS file which the minify process failed on, and may be indicative of other issues (e.g. insufficient monitoring of the deployment process), but CSS files are used by ...
Matthew's user avatar
  • 27.3k
2 votes

Stealing page source via Clickjacking

Stealing information is not easily possible and not what Clickjacking is really about. Clickjacking is functionally similar to CSRF, in that you can perform actions on the site across origins, but ...
tim's user avatar
  • 29.6k
2 votes
Accepted

XSS in custom, user-supplied CSS

This approach does not seem ideal since it is common to find bypasses when it comes to blacklists. There are some great resources out there such as "Scriptless Attacks – Stealing the Pie Without ...
EdOverflow's user avatar
  • 1,306
2 votes
Accepted

Is it true that frontend validation is generally redundant for minimalist contact forms on minimalist environments?

I would say that frontend and backend validation are not redundant because they serve different purposes: Backend validation: enforcing the data format as it enters the application. Frontend ...
Mike Ounsworth's user avatar
2 votes
Accepted

Can XSS ever occur in an <img> tag's "src" attribute?

The HTML spec states that the src attribute must point to a valid image resource that is neither paged nor scripted. The src attribute must be present, and must contain a valid non-empty URL ...
nobody's user avatar
  • 11.6k
1 vote

Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?

You are assuming that distinguishing yourself from the others will only be done if Javascript is enabled. But, assuming that all but you have Javascript enabled , exactly disabling Javascript might ...
Steffen Ullrich's user avatar
1 vote
Accepted

Is there any way for a Content-Security-Policy to block a CSS function, (specifically the url() function)?

Content Security Policy provides only a way to restrict the target of a request based on the context of the target but not on the actual source of the target. Thus it is not possible to restrict ...
Steffen Ullrich's user avatar
1 vote
Accepted

What can a 3rd party learn about a user through only CSS and images?

This answer might be considered as a partial answer since it's not intended to be exhaustive. With CSS only, a 3rd party can indeed (to a certain point) fingerprint a user's browser by: CSS querying ...
Soufiane Tahiri's user avatar
1 vote

Site inaccessible with Cookies turned off in browser

My website is simple (a blog) HTML and CSS and I store nor ask for any data from the visitors. Are you sure your site is only HTML+CSS? Your site wouldn't happen to be using some free hosting service ...
Mike Ounsworth's user avatar
1 vote

Why doesn't CSP block JS from modifying an element's style?

If an attacker can run javascript on the page, then you've already failed to prevent the attacker from getting code execution. CSP is mainly for preventing them from getting that far.
Macil's user avatar
  • 1,492
1 vote
Accepted

How to send remotely loadable CSS with an email as explained in ROPEMAKER whitepaper?

There are two ways of include resources inside an email HTML part: as links to external sites (i.e. <img src=http://example.com/... or <link rel=stylesheet href=http://example.com/...) or by ...
Steffen Ullrich's user avatar
1 vote

Is it dangerous to allow customers to refer to fonts.googleapis.com in their scripts?

Font files cannot contain client-side script. You would however need to allow the locations within any Content Security Policy you will be using (font-src directive), therefore this will be ...
SilverlightFox's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible