Hi,

I really like this module. But some friends of mine think its evil because it might be exploited to support XSS attacks.

So my Idea is to add filter_xss to the CSS write function. By this no evil code can be entered but the CSS will stay sane as it normaly does not use any HTML special chars. In my tests it worked just fine.

Of course this means you can't enter any JS into the CSS but if you are familare with that I believe you can easily do this by template.php or some module.

I post this as feature request as it is not really a but.

CommentFileSizeAuthor
css_injector-filter_xss-D6-v01.patch480 byteskars-t

Comments

kars-t’s picture

kars-t commented

I just figured that my patch is the wrong way round. I can't patch against CVS today for some reasons. And child selectors will probably removed by filter_xss. But maybe we just replace > by > after the escaping.

heine’s picture

heine commented

From the filter_xss api doc: "$string The string with raw HTML in it. It will be stripped of everything that can cause an XSS attack."

It makes no sense to run it on anything other than HTML.

kars-t’s picture

kars-t commented
Status: Needs review » Closed (fixed)

It makes no sense to run it on anything other than HTML.

Okay I am sorry. For some reason I thought that you would need script tags inside of CSS to use JS and that this would be a nice solution. So I am closing this as it really is no solution :(