3.14 Things I Didn't Know About CSS
summary
Shows concrete surprises and working demos: replicating !important by repeating a class, faking single-line comments by sending invalid property names, and building a CSS-only mini game that uses the Link HTTP header and the content property to render with almost no HTML; provides a utility and mentions the css.escape polyfill for selecting weird IDs; demonstrates data exfiltration by brute‑forcing attributes with attribute selectors and warns that CSS expressions re-enabled via IE document mode and iframe hosting let JavaScript run from CSS, and that Firefox can execute javascript: backgrounds causing crashes.
AI-written summary · about
chapters (15)
- 0:00Intro
- 2:25New !important best practice
- 2:57CSS comments
- 5:34Valid HTML
- 8:25CSS without HTML
- 10:11Classes and IDs in HTML
- 11:32Escaping CSS selectors
- 15:15Injection contexts
- 19:51Stealing data from the DOM
- 22:21IE's legacy document modes
- 22:59CSS Expressions in IE s 10
- 24:24How to avoid CSS expression vulnerabilities?
- 25:45Freezing Firefox
- 27:14What band is this?
- 27:29What song is this?
