DOMPurify demo: Hook to sanitize CSS

<a href="#" style="border:1ps solid blue;color:red;background:url(/images/test.gif)">ABC</a> <style> big { list-style: url(https://leaking.via/css-list-style); list-style-image: url(https://leaking.via/css-list-style-image); background: url(https://leaking.via/css-background); background-image: url(https://leaking.via/css-background-image); border-image: url(https://leaking.via/css-border-image); border-image-source: url(https://leaking.via/css-border-image-source); shape-outside: url(https://leaking.via/css-shape-outside); cursor: url(https://leaking.via/css-cursor), auto; color:red; } </style> <big>DEF</big> <svg> <style> circle { fill: green; mask: url(https://leaking.via/svg-css-mask#foo); filter: url(https://leaking.via/svg-css-filter#foo); clip-path: url(https://leaking.via/svg-css-clip-path#foo); } </style> <circle r="40"></circle> </svg> <style> @media all, not print and not monochrome, (min-width: 1px) { body { background: url(https://leaking.via/css-media-query); font-family: expression(alert('url()')); -webkit-animation: rotate-a-bit; -webkit-animation-duration: 1s; } } @font-face { font-family: leak; src: url(test.woff); } strong { font-family: leak; color:blue; background: url("/images/test.gif"); } strong:after { content: 'hola!'; } </style> <strong>GHI</strong>