I'm working on a site that customers will use by embedding it in an iframe in their site. I want to give them the ability to customize the styling of the contents so they can make it fit in with the styles of their site.

The basic idea I have is to let them give me the URL to a CSS file I should include in the page I serve to them to fill the iframe. As far as I know this is safe, but I'm not particularly familiar with CSS (especially the newer versions), so I want to verify this.

Is there any way someone could construct a CSS file that would let them inject code into my site or otherwise gain access to things like my domain's cookies? Is this really safe, or do I need to e up with a different solution?

I'm working on a site that customers will use by embedding it in an iframe in their site. I want to give them the ability to customize the styling of the contents so they can make it fit in with the styles of their site.

The basic idea I have is to let them give me the URL to a CSS file I should include in the page I serve to them to fill the iframe. As far as I know this is safe, but I'm not particularly familiar with CSS (especially the newer versions), so I want to verify this.

Is there any way someone could construct a CSS file that would let them inject code into my site or otherwise gain access to things like my domain's cookies? Is this really safe, or do I need to e up with a different solution?

• javascript
• css
• security
• xss

• 1 I think you'd be better off allowing users to paste custom styles into a textarea and then you can validate that it is actually CSS and nothing harmful before including it in your views. – Chris Schmitz Commented Aug 22, 2011 at 20:58

1 Answer 1

No it is unsafe. expression and -moz-binding are known ways to cause arbitrary script execution on certain browsers via CSS. LiveJournal suffered a very public XSS attack that was due to JavaScript embedded in user-supplied CSS.

With Mozilla deciding to allow the execution of arbitrary JavaScript via CSS, there is no other viable solution than the one we have undertaken.

From Caja's attack vector wiki:

Crafted CSS stylesheets can execute unsanitized javascript in the global scope on some browsers.

Background

CSS includes several mechanisms for changing the surrounding markup and executing expressions.

IE has an extension that allows execution of arbitrary javascript. The expression property is described at http://msdn2.microsoft./en-us/library/ms537634.aspx

Using the power of dynamic properties, it is now possible to declare property values not only as constants, but also as formulas. ... For scripting, a dynamic property can be any legal JScript or Microsoft Visual Basic Scripting Edition (VBScript) statement. http://msdn2.microsoft./en-us/library/ms533503.aspx

binding allows binding to externally specified scripts http://developer.mozilla/en/docs/CSS:-moz-binding & http://developer.mozilla/en/docs/XBL:XBL_1.0_Reference:Elements#binding

-moz-binding allows binding via the XML interface (also using data: URLs)

Assumptions

Untrusted code can generate style elements or style attributes or otherwise add arbitrary CSS rules and create DOM elements that trigger those rules.

Versions

IE 5 and later (but not IE 8 or later in "standards mode").

Mozilla/Firefox, versions not known.