Re: [csswg-drafts] [css-syntax] Consider disallowing NULL code points in stylesheets

> The rationale is that NULLs in a stylesheet are not useful, and NULL code points could be an indication of a buffer overrun, or an attempt of an attack by inserting NULL code points into the stylesheet.

Or another possibility - that you're trying to exfiltrate a local file (like a sqlite database) by getting it parsed as CSS and hoping you can capture a useful chunk of it in a `url()` function pointing to a malicious server.

I'm in support of this. At *bare minimum*, I'd like to automatically invalidate any property or rule containing a NULL, but I'm okay with killing the entire stylesheet too.  Anything's better than Firefox's current "eh, just treat the property like it ended" behavior upon encountering a null while parsing a property.

-- 
GitHub Notification of comment by tabatkins
Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/2757#issuecomment-396337601 using your GitHub account