“Blind CSS Exfiltration: exfiltrate unknown web pages | PortSwigger Research”
If you allow unvetted CSS, this is why you need to both limit all url references to an allow list and to probably block CSS variables as well
... works as a web developer in Hveragerði, Iceland, and writes about the web, digital publishing, and web/product development
These are his notes
“Blind CSS Exfiltration: exfiltrate unknown web pages | PortSwigger Research”
If you allow unvetted CSS, this is why you need to both limit all url references to an allow list and to probably block CSS variables as well