Sanitize for style attributes

7 views
Skip to first unread message

isguyra

unread,
Dec 12, 2012, 7:06:05 AM12/12/12
to rubyonra...@googlegroups.com
It's really confusing to decide whether sanitize will help avoid XSS in case when :attributes => %w( style ) 

on stackoverflow, people say that it is not safe, yet the examples they give such as

style="background-image: url(javascript:[code]);"

is being filtered out using sanitize and all that is left is style="" 

is there a way to get a definite answer if sanitize with style allow will protect against XSS or not?
Reply all
Reply to author
Forward
0 new messages