Which characters are safe so as not to escape with a CSS value context?

Question

I have a string that comes from the user and then is inserted into a large CSS block using a CSS parser.

CSS escaping can be done using \C (where C is a character), \HexOfC (with a space) or \6DigitHexOfC .

Generally, all characters can be escaped safely, and CSS will still work as expected. The following works:

 div { background: \23 f66; } 

 <div>Test</div> 

However, I still want the CSS properties as clean as possible because I want, for example, to be able to view URLs and rules using an inspector.

---

There are characters that are clearly bad. {};\* must be escaped because they can be used to exit the current rule. I manage a whitelist (everything escapes, except for allowed) characters (unlike the blacklist, where everything is allowed, except that it is not). I have white characters that I currently have

 '#', ',', '.', '(', ')', '-', '%', '+', '=', '/', ' ', ':', '\'', '"', '\n', '\r' 

Are there dangerous characters here? Anything you can use to break out of the rule and influence the rest of the CSS block. Are there any characters who are not here who might get an unnecessary escape? (Alphanumeric characters are not escaped by default).

Answer 1

Instead of sanitizing the input, you can simply pass in the items.

Basically a structur file created by the client:

 [ MyDiv: { # Key background: "#FFFFFF" # Element } ] 

In this case, you just need to create the file.

Dummy Code:

 StringBuilder sb = new StringBuilder(); foreach(String key: structure.getKeys()) { final List<Element> e = structure.getElements(key); sb.append(".") // This may be changed of course .append(key) // ID or class based on type above .append("{") // Append Elements .append("}"); } 

Creating items should be easy.

Each item is simple

S: = element-key: element-value;

Then you can also use special commands for whitelisting.

If you want to continue disinfection, look here: http://www.w3.org/TR/CSS21/grammar.html#scanner