Strip the constructs an authored stylesheet may not use.
Author CSS is store-supplied, which puts it on exactly the same footing as
overlay_html: a file a visitor downloaded, applied to a page that holds a
live control socket. Two things are removed, and neither is about taste:
@import — it fetches a second stylesheet from anywhere, so the cap on
this one would mean nothing and the panel would make a request the author
never declared.
remote url(...) — same reasoning, plus every such URL is a beacon that
reports the kiosk's existence and IP to whoever hosts it. data: URIs
survive, so an author can still inline a background.
Stripped rather than rejected: a panel that refuses to style itself over one
bad rule is worse on an exhibit floor than one that drops the rule. The
result is injected through a <style> element's textContent, never
innerHTML, so it cannot smuggle markup either way.
Strip the constructs an authored stylesheet may not use.
Author CSS is store-supplied, which puts it on exactly the same footing as
overlay_html: a file a visitor downloaded, applied to a page that holds a live control socket. Two things are removed, and neither is about taste:@import— it fetches a second stylesheet from anywhere, so the cap on this one would mean nothing and the panel would make a request the author never declared.url(...)— same reasoning, plus every such URL is a beacon that reports the kiosk's existence and IP to whoever hosts it.data:URIs survive, so an author can still inline a background.Stripped rather than rejected: a panel that refuses to style itself over one bad rule is worse on an exhibit floor than one that drops the rule. The result is injected through a
<style>element'stextContent, neverinnerHTML, so it cannot smuggle markup either way.