Security filter improvements for user-defined CSS | World Anvil

Remove these ads. Join the Worldbuilders Guild

Security filter improvements for user-defined CSS

User Interface (UI) / User Experience (UX) · World presentation layer · Created by Corwan
declined
CSS -Styling -Customization -CSS-Selectors -Security-Filter
Please review the security filter characters and allow use of the following in custom CSS:
  • >
  • " and '
  • "body"
 

What functionality is missing? What is unsatisfying with the current situation?

Current security filter erases everything between a "prohibited character" and the next whitespace.

These characters however also include key symbols used in CSS, such as '>' (used to designate "direct descendant") or single and double quotes (used in expressions such as DIV[href~="character"]).

On top of that, "body" is another prohibited string - which causes many issues with styling; a number of HTML elements in the template use "body" in their CSS classnames, such as "panel-body" and "card-body". It becomes impossible to style these.

 

How does this feature request address the current situation?

This update would allow to properly customize existing themes with advanced CSS selectors. It would also make it possible to even address certain elements by their proper classname, since a number of elements are literally named "[something]-body" .. and we are not allowed to use "body" in CSS.

 

What are other uses for this feature request?

The Team's Response

This is not a feature request.   This suggestion is absolutely out of the question.
  • BODY will never be allowed to be directly tampered with since that will give access to top level sections that will impact the WA interface
  • ' " and > can have major security repercussions
  • Current score

    4/300 Votes · +920 points

    Votes Cast