Hacker News Reader

I'm mostly a server dev, and I'm keen on a nice strict Content-Security-Policy (CSP) header which rules out inline CSS. The benefits (preventing extensions etc. from injecting style in a way which may constitute an attack) outweigh the convenience of inlined CSS for components in my opinion.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

View on HN

I’m curious. Can you provide an example where CSS can constitute an attack?

How does your CSP stop a script from adding styles to DOM elements? <script> document.querySelector(‘body’) .setAttribute(‘style’, ‘my malicious css?’); </script>

Attack is stretching the term sightly, I admit. It’s possible for a malicious style to reorganise things on a page in a misleading way, or place a lewd image in a background for example.

Edit: As for scripts adding things, the CSP prevents the style attribute being applied iirc.

Reply on news.ycombinator.com