title: XSS attacks and style attributes
body: <p>There are known Style Attribute XSS attacks like:</p>
  
  <pre><code>&lt;DIV STYLE="width: expression(alert('XSS'));"&gt;
  </code></pre>
  
  <p>Or</p>
  
  <pre><code>&lt;DIV STYLE="background-image: url(javascript:alert('XSS'))"&gt;
  </code></pre>
  
  <p>All the examples <a href="http://ha.ckers.org/xss.html">I've seen</a> use either expression or url functionality - basically something function like that require "(" and ")".</p>
  
  <p>I'm thinking of following method of filtering style tags, I would check them using following (approximately) grammar:</p>
  
  <pre><code>identifier: [a-zA-Z_][a-zA-Z0-9\-]*
  number: [0-9]+
  string: '[a-zA-Z_0-9 ]*'
  value : identifier | number | string | number + "(em|px)" | number +"%"
  entry: identifier ":" value (\s value )*
  style: (entry ;)*
  </code></pre>
  
  <p>So basically I allow ASCII properties with numeric values or very limited string values (basically for font names) not allowing using anything that looks like call.</p>
  
  <p>The question is this good enough? Are there any attacks that may do something like that:</p>
  
  <pre><code>&lt;DIV STYLE="this-is-js-property: alert 'XSS';"&gt;
  </code></pre>
  
  <p>And succeed?</p>
  
  <p>Can anybody think of XSS vulnerability of such test?</p>
  
  <p><strong>To Make it clear</strong></p>
  
  <p>I need style attributes as many tools like TinyMCE use them and filtering harmless
  style attributes off would significantly hurt the functionality.</p>
  
  <p>So I prefer pass common cases removing all things that may use @import, url, expression etc. And also make sure that basic css syntax is ok.</p>
  
  <p><strong>Answer</strong></p>
  
  <p>No it is not safe due to click-jacking vulnerability.</p>