3 ms·
Do these work on reddit where you can have user submitted CSS stylesheets for your subreddits?
by zawerf 9y ago
Do these work on reddit where you can have user submitted CSS stylesheets for your subreddits?
- anglebracket 9y agoThey shouldn't. These examples all rely on being able to cause an image load on a host the attacker controls if the CSS rule is applied. reddit blocks stylesheets that reference off-site resources. See https://github.com/reddit-archive/reddit/blob/master/r2/r2/lib/cssfilter.py#L413-L428 https://github.com/reddit-archive/reddit/blob/master/r2/r2/l...