Page MenuHomePhabricator

Allow unknown properties in css-sanitizer
Open, Needs TriagePublic

Description

The MW core Sanitizer allows all properties except for accelerator, -o-link, -o-link-source and -o-replace. It allows all values except when they contain the functions url(), src(), image(), image-set(), or attr() with the url syntax type. We could do the same in TemplateStyles.

Unknown properties would still have to be syntactically valid. We could have a generic matcher that would check for bad functions or URL tokens.

CSS is complex and constantly changing. Most changes are not relevant for security. There is @supportsto help users develop CSS which works across all platforms.

Event Timeline

This kind of comes down to what is the threat model of css-sanitizer and what does it want to prevent. I feel like a lot of css-sanitizer development is paralyzed by not knowing what the goal is.

The property names mentioned above only matter to ancient browsers. In modern browsers the only thing that really matter are @import, url(), image() and image-set(). If you care about standards not yet implemented, then also src() and filter() [attr() with url type was removed from spec and nobody ever implemented it].

The MW core Sanitizer allows all properties except for accelerator, -o-link, -o-link-source and -o-replace.

Also expression which let you embed Javascript in CSS on IE6. I suppose it is reasonable to assume that no future browser will do something that stupid...