René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Low][ssr] bq-style allows CSS declaration injection from untrusted style objects","articleBody":"## Severity: 🟢 Low (CSS injection — no HTML breakout)\n\n## Location\n[`src/ssr/renderer.ts:140-150`](../blob/main/src/ssr/renderer.ts#L140-L150) (`setStyle`).\n\n## Description\nStyle property names/values from an evaluated `bq-style` object are concatenated into the inline `style` attribute with no CSS-level validation. Attribute-level escaping prevents HTML breakout (`\"` is entity-encoded on serialize), so this is **not** XSS, but untrusted style objects can inject arbitrary extra declarations for UI-redress/clickjacking or data exfiltration (`position: fixed`, `background: url(...)`).\n\nReproduced: `{ width: 'x;} body{display:none' }` → `style=\"width: x;} body{display:none;\"` (contained within the attribute, but the extra declaration is injected).\n\n## Suggested fix\nValidate declaration values (reject `;`/`}`/`url(` in untrusted values, or run through a CSS property/value allowlist) before concatenation.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:44.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/176/bQuery/issues/176"}