-
-
Notifications
You must be signed in to change notification settings - Fork 647
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
update 5.3.1, #1589 #1943
update 5.3.1, #1589 #1943
Conversation
Commented: #1589 (comment) |
Per #1589 (comment) I think we need to leave the CSS encoding in. Here is a copy of that comment to make it easier.
This addresses sanitizing user authored cunks of CSS. Just like untrusted HTML is need to be sanitized.
This addresses adding user controlled data, like a color, into blocks of otherwise static css, which requires CSS encoding. Different controls and to some degree different attacks, too. I suggest: |
I don't think this wording is perfect but it has taken too long to spend further on it for now. |
This Pull Request relates to issue #1589