Re: Risks from CSS injection

On Dec 9, 2009, at 11:30 AM, gaz Heyes wrote:

> So you may think that getting the width is ok, right? Here I use the  
> width as a reference to the letter:-
>
> input[value*="a"] {
>  width:0;
> }
> input[width="0"] {
>  background:attr(width, url);
> }
> input[value*="b"] {
>  width:1;
> }
> input[width="1"] {
>  background:attr(width, url);
> }

Selectors cannot select based on CSS property values, as opposed to  
DOM attribute values. So what you write here won't work. It's setting  
the width CSS property, not the width attribute in the DOM, but the  
other selectors are reading from the DOM.

I think that in general there will never be a CSS selector that  
depends on the value of CSS property, because then style resolution  
could cause an infinite loop.

Regards,
Maciej