style considered harmful?

Question

We have some code that removes "dangerous" attributes and tags from HTML. I noticed that style is among the list of "dangerous" attributes. What could be the risk from that attribute?

Answer 1

In IE you can include @behaviors in there which can load little Javascripts.

With CSS3 you can also interject little bits of text, which could be dangerous depending on your website.

Answer 2

Here's an example of a bug in MediaWiki that creates a vulnerability based on inline style attributes.

Answer 3

It's possible to make things that are invisible or otherwise very deceptive using style sheets. For example, you could put a giant, invisible anchor link over the whole page so that when the user clicks on something, he's taken to an identical page on a server in Russia.