Allowing user css

Question

I'm allowing user css.

I'm taking their css input, creating a style, and just inserting it.

Are there any security issues I need to consider.

Do I need to validate that css?

Thanks.

Answer 1

Yes you do need to be careful, you can take a look at these for more info:

• Ultimate XSS CSS Injection
• HTML/CSS Injections - Primitive Malicious Code (or, What’s the worst that could happen?)