Block javascript execution from css

Question

When adding the below style attribute on a popular website in IE7 emulator nothing happened, but when I execute it from a trivial website in IE7 emulator it does get executed.

<body style="width: expression(alert())">

How can you prevent the expression from being executed?

Is this really an XSS problem? Would you allow your site's users to edit its styles? — nnnnnn
– nnnnnn, Commented Dec 22, 2016 at 1:03
@user3553031 I would also like to know what security measures can be taken for today supported browsers please. @/DanielA.White It's more about how the problem is solved than the problem itself. @/nnnnnn I would never let users do that, but I would like to know what to add so that if someone did it, we're safe — gr3g
– gr3g, Commented Dec 22, 2016 at 1:21

score 1 · Accepted Answer · 2017-01-03 18:39:39Z

1

As a mitigation against JavaScript being injected in unexpected places in modern browsers, use a content security policy. For instance, a CSP of script-src: none; will deny all JavaScript execution within your page, regardless of where it originated. More nuanced policies can be designed to allow JavaScript only from specific URIs, or only scripts with specific hashes.

edited Jan 3, 2017 at 18:39

answered Dec 22, 2016 at 1:26

user3553031

Sign up to request clarification or add additional context in comments.

2 Comments

gr3g Over a year ago

This is good for XSS, but here the malcious code comes from 'self'. But it's a good resource, thank you!

gr3g Over a year ago

This will not prevent HTC nor expression to be executed since it only works from IE11. But I agree it is a good first level of defense! Does your Javascript code gets executed when you deny javascript execution from self or is the self option for a JSF app?

Dekel · Accepted Answer · 2016-12-22 00:54:38Z

0

The feature you are talking about is called Dynamic Properties and is no longer supported as of IE8.

Dynamic properties (also called "CSS expressions") are no longer supported in Internet Explorer 8 and later, in IE8 Standards mode and higher. This decision was made for standards compliance, browser performance, and security reasons. Dynamic properties are still available in Internet Explorer 8 in either IE7 mode or IE5 mode. (For more information about document compatibility modes, see Defining Document Compatibility.) Because Internet Explorer 8 in IE8 mode is fully compliant with the Cascading Style Sheets, Level 2 Revision 1 (CSS2.1) standard, most dynamic properties written to work around Cascading Style Sheets (CSS)-related shortcomings in previous versions of Internet Explorer should no longer be needed. Other dynamic properties with more specific uses can generally be replaced with standard JavaScript.

answered Dec 22, 2016 at 0:54

Dekel

62.9k12 gold badges109 silver badges130 bronze badges

2 Comments

nnnnnn Over a year ago

So how does this answer the question about how it works or how to prevent it in IE7?

gr3g Over a year ago

I know it's not supported and deprecated, I want to know how they fixed this 5 years ago. Because that kind of issue still exist with HTC until IE9

Collectives™ on Stack Overflow

Block javascript execution from css

2 Answers 2

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related