1

I'm building an application which lets users input custom CSS for their own profiles (kinda like MySpace, Friendster, or Blogger).

The problem is I'm having a hard time finding a way to purify XSS attacks through CSS. I tried using HTMLPurifier, but it doesn't work. One example:

html {
    expression: alert('xss');
}

body {
    background-color: #FFF;
}

This would be allowed by HTMLPurifier.

Are there any settings I need to use for HTMLPurifier to make this invalid?

Thanks!

Update
Is expression: the only way to push an exploit via CSS? If so, would a regular expression be more efficient than using HTMLPurifier?

Nikko
  • 1,276
  • 2
  • 14
  • 25
  • 1
    why allow the use of "expression" in the first place? – Quamis Jun 02 '11 at 08:25
  • Since the user will be inputting the CSS themselves, I can't guarantee that they won't use it. Is "expression:" the only way to run an exploit through CSS? If so, then a regular expression would be more efficient correct? – Nikko Jun 08 '11 at 09:13
  • This answer shows how to configure HTMLPurifier and CSSTidy to sanitize CSS: http://stackoverflow.com/questions/3241616/sanitize-user-defined-css-in-php – Synchro Dec 19 '12 at 15:40

2 Answers2

2

HTML Purifier operates on HTML input, not CSS. That being said, you can probably trick it to work on CSS style sheets by wrapping the style sheet in style tags and turning on %Filter.ExtractStyleBlocks. You'll need CSS Tidy installed.

Update. No. There are many ways to deliver CSS payloads and searching for expression is not enough.

Edward Z. Yang
  • 26,325
  • 16
  • 80
  • 110
0

$str = preg_replace("/expression[\s:\]+/", '', $str) would remove the expression string.

In my oppinnion it may be better to simply "ban" or otherwise mark the user that tries to input this stuff to your site. Dont know about other ways to break a browser by using CSS, maybe @Edward can help here:)

Quamis
  • 10,924
  • 12
  • 50
  • 66
  • Banning them would be a good cure, but what I'm looking for is a preventive measure. Besides, it won't be scalable when you've got a lot of users who have a lot of custom pages. – Nikko Jun 21 '11 at 11:33