3 ms·
Not sure strict CSS parsing would have avoided this issue, since you could just surround what the purifier thought was a style text node with /* and */ (which i
by missblit 6y ago
Not sure strict CSS parsing would have avoided this issue, since you could just surround what the purifier thought was a style text node with /* and */ (which is valid CSS, being a comment)
- securitymb 6y agoEven if comments were stripped (which sometimes happens), you could still put it in the URL or font family name: * { font-family: '</math>...'; }
- kijin 6y agoSanitizers are not required to keep the original content intact. They absolutely can, and should, strip invalid and/or suspicious content from CSS strings.