3

I'm looking at allowing users of our online system to control their own .css files with us by simply including them on a user by user basis.

What is the best way to avoid any potential XSS attacks in said files?

Is it possible to completely protect ourselves at all?

It would be possible for us to host the files for them and obviously then check them ourselves but it would be more convenient for our users to be able to update them as well.

Tunaki
  • 132,869
  • 46
  • 340
  • 423
Richard Bourne
  • 31
  • 1
  • Take a look at this question, maybe it will help you somehow. http://stackoverflow.com/questions/1364302/how-to-preform-whitelist-based-css-filtering-in-php – Ionuț G. Stan Apr 21 '11 at 15:34
  • Watch out for IE: it can execute code (and styles) *from* stylesheets. Other than that, how can you perform XSS with a stylesheet (sorry for asking, but I'm not sure how that's done)? – Blender Apr 21 '11 at 15:34
  • Thanks for setting me straight, gents. Sorry for spreading lies. – Winfield Trail Apr 21 '11 at 15:47

2 Answers2

2

The problem with allowing CSS is that many clever attacks can occur. CSS can be very dangerous indeed.

Some CSS expressions allow executing arbitrary JavaScript. This is difficult to prevent by blacklisting, so I'd suggest whitelisting.

Additionally, someone may create a CSS file that changes the page to impersonate another site, another page, or maybe it cleverly orients other elements on the page. Imagine if someone were able to position their own login form above your real one. Then they could intercept login requests. Depending on how your site is set up, this may or may not be possible; but be forewarned! Some know this as clickjacking.

Chris Laplante
  • 29,338
  • 17
  • 103
  • 134
2

Firstly, exercise caution, as others have said. Beyond that though, try and white-list the valid inputs you'd expect in the file. See if you can locate any libraries for your chosen framework (you haven't mentioned what this is), that can validate a string for CSS structure compliance.

The other thing you might to consider is parameterising certain CSS attributes and allowing users to configure them (i.e. color, font etc). This would significantly mitigate your risk as it takes out the ability to arbitrarily create your own malicious CSS (and conversely, create your own innocent CSS!)

As for your original question "Is it possible to completely protect ourselves at all?", that's easy - no!

Troy Hunt
  • 20,345
  • 13
  • 96
  • 151