3 ms·
Even if comments were stripped (which sometimes happens), you could still put it in the URL or font family name: * { font-family: '</math>...'; }
by securitymb 6y ago
Even if comments were stripped (which sometimes happens), you could still put it in the URL or font family name:
* { font-family: '</math>...'; }
- kijin 6y agoSanitizers are not required to keep the original content intact. They absolutely can, and should, strip invalid and/or suspicious content from CSS strings.