[Webkit-unassigned] [Bug 184542] CSS variables (custom properties) bug & a potential crash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=184542

--- Comment #5 from Roman Komarov <kizmarh at ya.ru> ---
Any news about this?

I find that having a case where 22-characters if CSS cause a crash to be rather dangerous, as it could be possible to use it as an attack, by inserting it somewhere where you have an access to CSS/HTML, and via it basically disabling the browsing experience for anyone using Safari.

Also, a question: is it something that would be safe to write about in social networks, so people would know that this is possible and could potentially protect themselves by stripping CSS variables from any user-generated fields, and also as an interesting anecdote about the circularity in CSS?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20181003/626660b3/attachment.html>