Best way to sanitize untrusted CSS with Python

Question

I want to allow my users to upload their own CSS to customize the look, but CSS can be used to run javascript. What is the best way to sanitize it with Python?

I found some answers on other langugages: Sanitizing CSS in Rails, Sanitize CSS Using Java, Sanitize user defined CSS in PHP but found nothing on python.

I did find https://pythonhosted.org/feedparser/html-sanitization.html#css-sanitization but this is a bit too limiting, i.e. not allowing url at all.

You could scan for url and expression property values: stackoverflow.com/a/482088/2653390 since those appear to be the only two ways to inject JS with CSS — Shashank
– Shashank, Commented Apr 29, 2015 at 5:42

Stephen Rodriguez · Accepted Answer · 2015-04-29 05:51:07Z

0

From your links, it looks like you would either have to whitelist or blacklist some stuff. Personally, if you are informed enough, try blacklisting unwanted components. As for parsing, have you looked into CSSUtils for Python ?

answered Apr 29, 2015 at 5:51

Stephen Rodriguez

1,0371 gold badge12 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Best way to sanitize untrusted CSS with Python

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related