This library takes a blocklist (or allowlist) of CSS properties and sanitizes for known CSS exploits.
styles is an object with its keys being CSS selectors and values being CSS property key-value pairs.
var stylesheet = injectStylesheet.injectWithBlocklist(styles [, blocklist]); var stylesheet = injectStylesheet.injectWithAllowlist(styles [, allowlist]);
stylesheet will refer to the
<style> tag that was injected into the
<head> of the document.
var injectStylesheet = ;var styles ="input":"font-size": "16pt""color": "#3A3A3A"".invalid":"color": "tomato""@media screen and (max-width: 700px)":"input":"font-size": "14pt";var allowlist = 'font-size' 'color' ;var blocklist = 'background' 'display' ;injectStylesheet;injectStylesheet;
Selectors are filtered for things such as
Keys are filtered based on whether or not a blocklist or allowlist was given.
injectStylesheet will assume that its second parameter is a blocklist unless the third parameter is
true, which will designate it as a allowlist. This listing is used to filter the given CSS properties for exclusion or inclusion.
Values are checked against usages of
evaluate(), and other potentially abused and powerful CSS functions.
All modern browsers, and IE9+