Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Path-relative style sheet import vulnerabilities

Tags:

css

security

To avoid path-relative style sheet import vulnerabilities should I attach css file on my page using full path e.g.

<link href="http://mywebsite/style.css" type="text/css" rel="stylesheet" />

instead of

<link href="style.css" type="text/css" rel="stylesheet" />

What do you think?

like image 870
user3896104 Avatar asked Mar 25 '15 15:03

user3896104


1 Answers

Just add a leading slash and make the path root-relative, rather than relative which this vulnerability relies on.
No need for the domain / scheme.

 <link rel="stylesheet" href="/style.css">
like image 116
Adria Avatar answered Sep 27 '22 22:09

Adria