Is it safe to allow users to edit css?

Question

I have a web application where I would like to allow end users to customise the look of the web site by uploading their own css file.

Are there any security issues with this? I can't see anything obvious but thought I'd ask in case there was anything I'd missed.

Answer 1

Javascript can be executed in CSS, you have to make sure that you are using some filtering.

I have also seen incidents where someone has covered the entire page on a microsoft controlled site with a transparent pixel, linking to a malicious site. Clicking anywhere triggered the attackers site to appear.

This could however be safe if the user only sees his or her own CSS, and they would have no way of someone else viewing what they have done. Otherwise some sort of whitelist or markdown would work.