CODEWITHSUNDEEP
htmlsecurity
JoelFan
JoelFan

Reputation: 38714

style considered harmful?

We have some code that removes "dangerous" attributes and tags from HTML. I noticed that style is among the list of "dangerous" attributes. What could be the risk from that attribute?

Upvotes: 5

Views: 125

Answers (3)

Chuck
Chuck

Reputation: 237060

It's possible to make things that are invisible or otherwise very deceptive using style sheets. For example, you could put a giant, invisible anchor link over the whole page so that when the user clicks on something, he's taken to an identical page on a server in Russia.

Upvotes: 1

Jacob Mattison
Jacob Mattison

Reputation: 51062

Here's an example of a bug in MediaWiki that creates a vulnerability based on inline style attributes.

Upvotes: 2

Kevin Sedgley
Kevin Sedgley

Reputation: 1069

In IE you can include @behaviors in there which can load little Javascripts.

With CSS3 you can also interject little bits of text, which could be dangerous depending on your website.

Upvotes: 2

Related Questions