2 ms·

I’m curious. Can you provide an example where CSS can constitute an attack? How does your CSP stop a script from adding styles to DOM elements? <script> docume

I’m curious. Can you provide an example where CSS can constitute an attack? How does your CSP stop a script from adding styles to DOM elements? <script> document.querySelector(‘body’) .setAttribute(‘style’, ‘my malicious css?’); </script>

qubyte 6y ago
Attack is stretching the term sightly, I admit. It’s possible for a malicious style to reorganise things on a page in a misleading way, or place a lewd image in a background for example. Edit: As for scripts adding things, the CSP prevents the style attribute being applied iirc.