To avoid path-relative style sheet import vulnerabilities should I attach css file on my page using full path e.g.
<link href="http://mywebsite/style.css" type="text/css" rel="stylesheet" />
instead of
<link href="style.css" type="text/css" rel="stylesheet" />
What do you think?
Just add a leading slash and make the path root-relative, rather than relative which this vulnerability relies on.
No need for the domain / scheme.
<link rel="stylesheet" href="/style.css">
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With