update 5.3.1, #1589

[elarlang]

This Pull Request relates to issue #1589

[tghosth]

Commented: #1589 (comment)

[jmanico]

Per #1589 (comment) I think we need to leave the CSS encoding in. Here is a copy of that comment to make it easier.

I think we need both 5.2.8 and 5.3.1
5.2.8 | Verify that the application sanitizes, disables, or sandboxes user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode, or similar.
-- | --

This addresses sanitizing user authored cunks of CSS. Just like untrusted HTML is need to be sanitized.

5.3.1 | [MODIFIED] Verify that output encoding is relevant for the interpreter and context required. For example, use encoders specifically for HTML values, HTML attributes, JavaScript, CSS, URL parameters, HTTP headers, SMTP, and others as the context requires, especially from untrusted inputs (e.g. names with Unicode or apostrophes, such as ねこ or O'Hara).
-- | --

This addresses adding user controlled data, like a color, into blocks of otherwise static css, which requires CSS encoding.

Different controls and to some degree different attacks, too.

I suggest:
| 5.3.1 | [MODIFIED] Verify that output encoding is relevant for the interpreter and context required, such as encoding the relevant characters for HTML elements, HTML attributes, CSS, JavaScript, URL parameters, HTTP headers, or SMTP.

error on my part

[tghosth]

I don't think this wording is perfect but it has taken too long to spend further on it for now.