Is there a security threat if I enable a user to add CSS? -

-

is not secure enable user add own rules of css personal page, in (for example) social website ?

it not secure. there multiple ways embed javascript in css such gets executed @ least browsers. google "xss css" , through top hits.

don't unless you're willing hardcore sanitization of css, , clean mess when sanitization inevitably bypassed , users' cookies compromised.


Comments

Post a Comment

Popular posts from this blog

Python __call__ special method practical example -

-
i know __call__ method in class triggered when instance of class called. however, have no idea when can use special method, because 1 can create new method , perform same operation done in __call__ method , instead of calling instance, can call method. i appreciate if gives me practical usage of special method. django forms module uses __call__ method nicely implement consistent api form validation. can write own validator form in django function. def custom_validator(value): #your validation logic django has default built-in validators such email validators, url validators etc., broadly fall under umbrella of regex validators. implement these cleanly, django resorts callable classes (instead of functions). implements default regex validation logic in regexvalidator , extends these classes other validations. class regexvalidator(object): def __call__(self, value): # validation logic class urlvalidator(regexvalidator): def __call__(self, valu...
Read more

arrays - jQuery - Retrieve values from HTML elements and return their sum -

-
i got form several checkbox 's user can choose multiple values, so: <div> <input id="myinput1" type="checkbox" value="choice_id_1" /> <label for="myinput1">5</label> </div> <div> <input id="myinput2" type="checkbox" value="choice_id_2" /> <label for="myinput2">10</label> </div> <div> <input id="myinput3" type="checkbox" value="choice_id_3" /> <label for="myinput3">10</label> </div> i need values each :selected checkbox label , return total sum (ie: total = 25) . so far have been trying strings labels .text() method, make array results, converting them int parsefloat() , sum array elements... obviosly no success. this got (for sure not best approach i'm open diferent solutions) : function totalsum() { var prices = $("...
Read more