Is <span style=...> safe for sanitize?

Question

I am using a rich text editor (CKEditor) and I have the opportunity to let users create profiles that are displayed to other users.

Many of the attributes CKEditor can control are being lost when I display them as:

<%= sanitize(profile.body) %>

My question is: is it safe to allow the attribute 'style' to be parsed? This would allow things like text color, size, background color, centering, indenting, etc. to be displayed. I just want to be sure it won't allow a hacker access to something I don't know about!

Camphene

Answer 1

is it safe to allow the attribute 'style' to be parsed?

No.

background-image: url(javascript:[code]);
width: expression([code]);                  /* ie */
behavior: url([link to code]);              /* ie */
-moz-binding: url([link to code]);          /* ff */

Not to mention UI-spoofing attacks like positioning a false login form over a real one or something.

Unfair

ha! Thanks very much, I had a feeling :) – Camphene

See also CSS Injection – Loats

This again shows that you cannot be safe with blacklisting. If you had not thought about blacklisting url rules in CSS you would have a problem now. You cannot even output a CSS string, you really need to fully parse it and only output the parsed DOM. – Intraatomic

but doesn't sanitize() use whitelisting? – Pluviometer

sanitize seems to filter these examples with :attributes => %w( style ) – Pluviometer