Home/ Questions/Q 6359625
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T23:32:36+00:00

I’m working on a site that customers will use by embedding it in an

  • 0

I’m working on a site that customers will use by embedding it in an iframe in their site. I want to give them the ability to customize the styling of the contents so they can make it fit in with the styles of their site.

The basic idea I have is to let them give me the URL to a CSS file I should include in the page I serve to them to fill the iframe. As far as I know this is safe, but I’m not particularly familiar with CSS (especially the newer versions), so I want to verify this.

Is there any way someone could construct a CSS file that would let them inject code into my site or otherwise gain access to things like my domain’s cookies? Is this really safe, or do I need to come up with a different solution?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    No it is unsafe. expression and -moz-binding are known ways to cause arbitrary script execution on certain browsers via CSS. LiveJournal suffered a very public XSS attack that was due to JavaScript embedded in user-supplied CSS.

    With Mozilla deciding to allow the execution of arbitrary JavaScript via CSS, there is no other viable solution than the one we have undertaken.

    From Caja’s attack vector wiki:

    Crafted CSS stylesheets can execute unsanitized javascript in the global scope on some browsers.

    Background

    CSS includes several mechanisms for changing the surrounding markup and executing expressions.

    IE has an extension that allows execution of arbitrary javascript. The expression property is described at http://msdn2.microsoft.com/en-us/library/ms537634.aspx

    Using the power of dynamic properties, it is now possible to declare property values not only as constants, but also as formulas. … For scripting, a dynamic property can be any legal JScript or Microsoft Visual Basic Scripting Edition (VBScript) statement.
    http://msdn2.microsoft.com/en-us/library/ms533503.aspx

    binding allows binding to externally specified scripts
    http://developer.mozilla.org/en/docs/CSS:-moz-binding & http://developer.mozilla.org/en/docs/XBL:XBL_1.0_Reference:Elements#binding

    -moz-binding allows binding via the XML interface (also using data: URLs)

    Assumptions

    Untrusted code can generate style elements or style attributes or otherwise add arbitrary CSS rules and create DOM elements that trigger those rules.

    Versions

    IE 5 and later (but not IE 8 or later in “standards mode”).

    Mozilla/Firefox, versions not known.

    • 0