Can scripts be hidden in css or image files

[Andre]

I'm writing a web-app which needs some javascript (my own) to be
executed locally.

This app can load local pages or remote ones; however I have a concern
about potentially malicious code in remote files. (it would be easy to
write javascript code that would make my web-app do nasty things :-(

For remote pages, I can strip embedded <script>...</script> as well as
<script src="..."/> before displaying it in the web app. However, I am
wondering if it's possible to "hide" other scripts either in css files
or image files that are loaded.

[What I do is "fetch" an html document and process it with my app, and
then feed it to my favorite browser (Firefox) which then loads the
relevant image files and css files (and, presently, other js files if
present) on its own.]

Any help or pointers would be appreciated.

André

 

[David Dorward]

For remote pages, I can strip embedded <script>...</script> as well as
<script src="..."/> before displaying it in the web app.

Don't forget <... onmouseover="somescript()";>

or <img src="javascript:somescript()";>

and so on.

However, I am > wondering if it's possible to "hide" other scripts either
in css files

Not by the standard, but IE and Firefox (at least) provide proprietary ways
to do so.

 

[Andre]

Don't forget <... onmouseover="somescript()";>

or <img src="javascript:somescript()";>

and so on.

Would all such "action tags" always include a "()" , or more generally,
"(some variables here)". I could possibly restrict attributes to be
only:
class /* needed for styling */
id /* same */
title /* needed by my app */
src /* needed for images and style files */ [but strip those if their
"value" includes some parentheses]

Not by the standard, but IE and Firefox (at least) provide proprietary ways
to do so.

Any pointers to the above mentioned proprietary way for Firefox? (at
this point, I've given up on IE).

 

[David Dorward]

Andre wrote:

Would all such "action tags" always include a "()" , or more generally,
"(some variables here)".

No. Such data could be represented by entities. In the case of URLs I
suspect it could be URL encoded too. There may be other techniques.

Any pointers to the above mentioned proprietary way for Firefox? (at
this point, I've given up on IE).

Sorry. Never used it.