title: Are there any xss reasons to block style elements and attributes?
body: <p>I’m using<code>Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'</code> and <code>X-Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'</code> for ɪᴇ. Browsers which don’t support ᴄꜱᴘ can’t use the page.<br>
  The allowed html is</p>
  
  <pre><code>p, div, blockquote, summary, details,h1, h2, h3, h4, h5, h6, h7, h8, a, img, b, i, strong, em, tt, code, ins, del, sup, sub, kbd, samp, q, var, s, strike, `table`, thead, tbody, tfoot, tr, td, th, svg, style
  </code></pre>
  
  <p>The allowed attributes are</p>
  
  <pre><code>abbr, accept, accept-charset, accesskey, action, align, alt, axis, border, cellpadding, cellspacing, char, charoff, charset, checked, cite, clear, cols, colspan, color, compact, coords, datetime, dir, disabled, enctype, for, frame, headers, height, hreflang, hspace, ismap, label, lang, longdesc, maxlength, media, method, multiple, name, nohref, noshade, nowrap, open, prompt, readonly, rel, rev, rows, rowspan, rules, scope, selected, shape, size, span, start, summary, tabindex, target, title, type, usemap, valign, value, vspace, width, itemprop, style
  </code></pre>
  
  <p>So scripting and external resource loading is disabled. Can I safely allow arbitrary ᴄꜱꜱ in that case <em>(I only care about xss here)</em> ?<br>
  I see no reason to do so, but most web sites like GitHub and StackOverFlow strip them <em>(comments are in iframes so<code>&lt;style&gt;</code>elements can’t change stylesheets of the parent)</em>.  </p>
  
  <p>Of course the best answer would be a small xss proof of concept.</p>