Hot answers tagged

44

In jQuery you can specify a CSS selector and HTML code with the same shorthand. This is a selector: $('#some-thing') This is HTML that gets evaluated immediately: $('<svg onload=alert(1)>') This is a real-life code sample for parsing a selector from the location hash (the URL part after a #): var x = $('#' + window.location.hash.substr(1)); x....


29

The email includes references to an externally-hosted images, like http://example.com/[tracking_id].png, where the tracking company controls the server hosting the image. The company records how and when each unique image URL is loaded by a mail client. As you've noted, print operations can be logged by a tracking image in the @media print CSS directive. ...


27

Regarding JavaScript: In Internet Explorer and some very old browsers, it's possible to inject JavaScript into stylesheets. Several ways to do this are described in the XSS Filter Evasion Cheat Sheet. The three major issues are: background-image and similiar: background-image: url('javascript:alert(/XSS/);') JavaScript expression: width: expression(alert(/...


18

It is not advisable to use CSS styles from a source you don't trust, without some sort of review. There are some risks, particularly on older browsers. Some older browsers provide a way to embed Javascript inside of CSS, so that the Javascript will be automatically executed as soon as the browser loads the CSS. Browsers with this problem include IE6, IE7, ...


13

Everything that is executed in the browser can be seen by the client, that is the nature of the Web. This includes HTML, javascript, and CSS. So, unless you put something confidential in a file that will be served by your browser, this is not an a vulnerability. Edit: below is from @schroeder's comment In addition, every single webpage can show the CSS ...


8

Yes, it is implicitly intended that clients will download CSS files and interpret it to figure out how to render a page. Whether that CSS is accessed automatically via a web browser or manually via a person does not really make any difference from a Security standpoint. You should consider the content of a CSS file to be public information unless it ...


8

Well, you can do it using the MutationObserver API. const inputPasswordElements = document.querySelectorAll('input[type=password]'); const observer = new MutationObserver(function (mutations) { mutations.forEach(function (mutation) { if (mutation.type === 'attributes' && mutation.attributeName === 'type') { mutation.target....


7

Yes, in the past there have been lots of exploits that only relied on malicious HTML and CSS code. You are right in that parsing a complex, turing-complete language is potentially more error-prone, giving an attacker more tools to craft an exploit. Yet, there are many different ways in which the implementation of the used CSS parser or other modules ...


7

Yes: CSS can contain malware, though in my experience, its usually been tied to a vulnerability, e.g. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3971 As far as it containing JavaScript, that's certainly a vector, though successful exploitation should generally be limited by vulnerabilities within the Browser, the OS and the JavaScript engine. ...


6

Posting a body such as this: realname%3DSisodiya%20Chhatrapalsinh%26email%3D%60rm%20-rf%20%2F%60%26comments%3DDo%20your%20own%20homework%26submit%3DSubmit


6

One tiny addition to comprehensive post of D.M. CSS2+ can also manipulate text on the page. See MDN for content CSS property details and this for examples. Compare this behaviour to expression() javascriptlets in IE6 CSS: in both cases CSS is performing smth more than just styling... Pity, this is a part of CSS standard.


6

No, that's not possible. A value to background-image will be rendered as an image. Even an SVG with embedded script code would just be displayed as an image when loaded via background-image. So XSS isn't possible here (the same way an arbitrary value to <img src="..."> can never lead to XSS). Even if you couldn't just change a background-image value ...


5

Welcome to Security.SE. The issue that you described is not a security vulnerability. The reason is that JavaScript and CSS files must be viewable by the browser so that your website can function normally.


5

CSS rules can actually contain JS code (supported by at least some browsers), so from that perspective CSS can be "as bad as" JS. This SO answer might be helpful if you want more detail. https://stackoverflow.com/a/482088


5

CAPTCHAs are one area of computer security where "roll-your-own" can be a good idea. In order to break a CAPTCHA, a bot needs to be programmed to recognize and solve the CAPTCHA. For low-volume, low-value sites, the cost to program a bot to handle even a trivial CAPTCHA such as this is greater than the expected value of breaking it. By the simple ...


5

Would rewriting HTTP addresses as HTTPS work? Only if the webserver hosting the images accepts https as well as http. I would say the solution is to grab the images, and host a copy yourself, which you serve to your clients. Take the URL (or parse the CSS for images), download a copy, and substitute.


4

Try not to see security from the developer's point of view, but instead, follow a set of best practices. For example, you will be accepting input from a user, in the form of a file upload or text input, sanitize the content nonetheless, look at the answers to this question for tips on how to sanitize user defined css. I would not assume that the css may ...


4

Open Chrome dev tools on any site you know has a source map included, click sources tab and you will immediately see why including source maps on prod is a bad idea. You will get a tonne of information on project structure as stored on disk. This is a particular problem for modern sites that use a component based framework. I.e every view has its own ...


4

The problem is when user-specified HTML is included together with your own HTML and application logic on the same page. It is common that the application logic depends on the content or location of specific elements inside the HTML which are selected based on id or class name. If you allow the user to specify any class name an attacker might be able to ...


4

Possibly. The response contains an URL inside CSS inside HTML. All three have different escaping regimes, and if the application's developer did not do escaping for one of these right, you might be able to sneak in an XSS one level beneath it. For example, what happens if the avatar URI ends in .../innocent.png')"><script src="malicious.js"></...


3

You could do this a few ways, here's some I'd suggest: Use a CSS Obfuscator This won't prevent people from stealing your css, but it will make working on it difficult. Build with JavaScript (& obfuscate) It's true that styles applied via element.style are added to the html and could be copied, but tools like element.appendChild could be a little ...


3

In theory, you're fine loading stylesheets and fonts from a third party - as you say, they're included in link tags, which shouldn't allow script execution. There are a few things which might cause information leakage though, and a potential for a targeted attack resulting in data appearing to change. In terms of information leakage, browsers by default ...


3

I get these questions from clients on a regular basis. The fundamental problem is that any email tracking technology requires cooperation from the client. The other answer dissected the image tracking so I won't repeat it here, other than to point out that the client must load the image from their server (said server is now on my block list). Web-based ...


3

They may well be crawling your website. They are almost certainly making automated requests and not rendering the content of your pages in the way that the usual web browsers would. A web client can report whatever User-Agent they like and may be trying to hide the fact that they're automated when they report the User-Agent commonly associated with web ...


3

All websites should be receiving regular attacks, if you are not begin attacked, please check your internet connection. A link is in no way shape or form "hidden" if a robot can find them. A malicious bot will use a robots.txt file to enumerate resources on your system ignoring the deny directive. Using a CAPTCHA will prevent automated attacks. Also ...


3

An expression() must be a JavaScript expression. You have two statements, a function declaration followed by an assignment expression. Doing it with a single function expression works for me: <div style="xss:expression(onload=function() { var newInclude = document.createElement('script'); newInclude.src = 'src.js'; document.body.appendChild(...


3

CSS history leak is now fixed by http://dbaron.org/mozilla/visited-privacy So to answer the question in the subject: negligible (just very outdated browsers, probably some <10%). However, history leaks are still the case. For the descriptions of real risks of history leaks here: http://w2spconf.com/2010/papers/p26.pdf and http://petsymposium.org/2012/...


3

If attacker replaces original CSS file with a malicious CSS file and if the web-server sends this malicious CSS file to the client, can the attacker execute some code in the client? Executing client-side code via CSS does not work in modern browsers. I highly recommend taking a look at "Scriptless Attacks – Stealing the Pie Without Touching the Sill", "CSS:...


3

Your question links to a blog post by Paul Irish, which mentions that this is now considered an anti-pattern. (Since 2017) Why was // used at all? The reasoning was that you could write //mysite.com/some/resource and it would resolve to either http://mysite.com/some/resource or https://mysite.com/some/resource, depending on whether or not the site was ...


2

Simply using the developer tools built into many browsers should be enough. Also it is probably easy to write some bookmarklet to show "hidden" parts of the page. Hiding with CSS is not a security feature (not even security by obscurity) but should only be used to hide some parts of the page for now, i.e. show a summary and hide details until the user wants ...


Only top voted, non community-wiki answers of a minimum length are eligible