3.14 things I didn't know about CSS
summary
Shows concrete surprises and exploits: how to fake importance by repeating classes, when font-family needs quotes and when it doesn’t, HTML vs CSS rules for unquoted attributes, and using parse errors as pseudo single-line comments. Demonstrates a CSS-only page via the Link HTTP header and content:, a CSS game, the CSS.escape API, brute‑force exfiltration via attribute selectors, and resurrected CSS expressions in old IE (via iframe + document‑mode) — recommends X-Frame-Options and the HTML5 doctype as mitigations.
AI-written summary · about
chapters (15)
- 0:00Intro
- 2:35important
- 4:04Font family names in CSS
- 7:20Unquoted attribute values
- 7:44CSS comments
- 11:10Valid HTML
- 16:47Classes and IDs in HTML
- 20:00Escaping CSS selectors
- 24:18Injection contexts
- 29:01Stealing data from the DOM
- 32:36IE's legacy document modes
- 35:24How to avoid CSS expression vulnerabilities?
- 37:12Freezing Firefox
- 38:27What band is this?
- 39:13What song is this?
