A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
<style>.demo { --accent:green; }</style><main class="demo">Example content</main>
Engineering judgment: Prefer typed, constrained values and sanitize at the boundary rather than attempting to blacklist individual CSS properties.
<style>.theme{color:var(--accent);}</style><main class="theme">Example content</main>
A good CSS change narrows the problem. Prefer typed, constrained values and sanitize at the boundary rather than attempting to blacklist individual CSS properties. This keeps the rule understandable when content, theme, or viewport conditions change later.
In production, Accepting arbitrary CSS strings from users is dangerous even when the visible output seems harmless. That is the kind of bug that survives visual spot checks because the stylesheet is syntactically valid while the layout contract is wrong.
| Concern | What to inspect | Typical failure |
|---|---|---|
| Core behavior | Preventing Unsafe CSS Injection Patterns | Accepting arbitrary CSS strings from users is dangerous even when the visible output seems harmless. |
| Production test | Real content and constraints | The rule works only for the demo values |
| Maintenance | Scope and override path | A later fix creates another exception |
The useful mental model here is practical: how attacker-controlled CSS values can produce UI manipulation or data-exfiltration-adjacent side effects. When a rule looks obvious but the browser produces something else, start by identifying which constraint or rendering phase is actually winning.
<style>.preview{background-image:var(--user-image);}</style><main class="preview">Example content</main>
Example 3 is useful here because it demonstrates preventing unsafe css injection patterns under a concrete input rather than as an abstract property list.
<style>.safe{color:rgb(0 0 0);}</style><main class="safe">Example content</main>
Example 4 is useful here because it demonstrates preventing unsafe css injection patterns under a concrete input rather than as an abstract property list.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.