5 ms·
I remember seeing a demo of a website which didn't have any tag - I think the stylesheet was served by an http header that the browsers were automatically linki
by arcatek 12y ago
I remember seeing a demo of a website which didn't have any tag - I think the stylesheet was served by an http header that the browsers were automatically linking. I can't find the url.
[edit] Here it is! It still doesn't work in Chrome. http://css-tricks.com/using-css-without-html/ http://css-tricks.com/using-css-without-html/
- nkozyra 12y agoFar more interesting than a simple exploitation of the 'content' CSS attribute.
- JetSpiegel 12y agoI can see where the next exploits will come from, the stylesheet doesn't even appear on Firefox Dev Tools.
- jakub_g 12y agoIt does for me (Fx35, Windows), but yeah this looks pretty obscure, like the recent bash exploits from 30-year-old features barely anyone knew. Apart from exploits, semi-related, I just hope the ad industry won't find out about using inline data URIs any soon. This would make ad blocking way more difficult.
- Retric 12y agoAdds are served from a separate IP in part to keep websites honest. As long as this happens browsers can fairly easily tell what's an add. IMO, a more risky option is for add networks to start hosting webpages and I can easily see Google taking this approach.
- M4v3R 12y agoPity that it doesn't work in Webkit/Blink browsers, only in Firefox (and old Opera).
- sirn 12y agoI remembered using this trick to put a "THIS IS STAGING" banner for my project back few years ago (after reading Eric Meyer's article[1]) It was pretty cool back then. [1]: http://meyerweb.com/eric/thoughts/2009/01/22/using-http-headers-to-serve-styles/ http://meyerweb.com/eric/thoughts/2009/01/22/using-http-head...
- TazeTSchnitzel 12y agoThis, combined with data: URIs, could be fun...
- jakub_g 12y agoSince we're talking about obscure hacks, I've seen a website putting ads in an <iframe>, whose URL was the same as the parent (top) URL, and there was even no HTTP request being done for an iframe document (probably due to the URL being already cached by the browser) - so it was not possible to block it via a blocking proxy. I only managed to block it with the adblock's element hiding query like `domain.com##iframe` or through a userscript.