Is it safe to allow users to edit css?

问题:

I have a web application where I would like to allow end users to customise the look of the web site by uploading their own css file.

Are there any security issues with this? I can't see anything obvious but thought I'd ask in case there was anything I'd missed.

回答1:

Javascript can be executed in CSS, you have to make sure that you are using some filtering.

I have also seen incidents where someone has covered the entire page on a microsoft controlled site with a transparent pixel, linking to a malicious site. Clicking anywhere triggered the attackers site to appear.

This could however be safe if the user only sees his or her own CSS, and they would have no way of someone else viewing what they have done. Otherwise some sort of whitelist or markdown would work.

回答2:

Short answer: no it isn't. HTC in IE and XBL in Mozilla are both potential attack vectors. A hack of this nature was used to steal 30,000 MySpace passwords a while back.

Source: Simon Willison, Web Security Horror Stories

回答3:

I wouldn't do it because CSS can show an image that could exploit some OS vulnerability in example.

Regards.

回答4:

Depending on your server and configurations, it may be possible to run server-side code from a CSS file (though, this isn't default behavior on servers I know).

回答5:

Short answer: no. First bad things that come to mind are MSIE expressions.

回答6:

If these CSS files are available to all site users, and not just the person who uploaded, then there's a possible XSRF vector - you could include links to offsite resources in the CSS which perform "undesirable" effects to the user requesting them.

回答7:

You may get customer support overhead if a user with his custom CSS screws the screen to that extent that he won't find the controls to reset it back. In which case you as admin will need to do it manually.

For that case a possible solution. Arrange for a specific Url to reset the style. Something like:

http://mysite.com/users/234234/reset

And advice to the user when he's about to modify the style to remember this Url and just follow it if things have gone out of control. When hit, the custom styles will be deactivated.