4 ms·
I created a video where any comment that was valid CSS would be added to the site without moderation. I suggest that you have a look at the site. Its a testame
by DanielBark 4y ago
I created a video where any comment that was valid CSS would be added to the site without moderation.
I suggest that you have a look at the site. Its a testament to programming joy.
Early on someone posted css that added a trollface that would zoom across the site. I realized that allowing images inside the css was simply to dangerous so whenever an image was included in the css i would have to approve the css before it being applied to the site.
This video explains how the technical setup was achieved.
https://youtu.be/z8b9WJ1oD8w https://youtu.be/z8b9WJ1oD8w
Hope you enjoyed this little experiment!
// Daniel
- arturventura 4y agoInteresting idea, but if you didn't filter the elements with URLs, you're creating a CSS injection attack that enables people who visit the website to work as bots in a botnet and attack some url.
- DanielBark 4y agoI did :)
- paulluuk 4y agoIt's fun! Are there any security considerations when allowing random CSS?
- kroltan 4y agoPrivacy ones by using URLs for images or imports that point to external domains, could leak who is visiting. There is also a way to do a CSS keylogger for input elements, but I don't think the website has any or that users would type anything sensitive. Beyond that, it's as safe as visiting any other website, especially if you don't use an ad blocker.
- oh_sigh 4y agoNot with content-security-policy set correctly(I think?)