brave/adblock-rust

Harden cosmetic filter validation

antonok-edm opened this issue · 1 comments

antonok-edm commented

This article describes a CSS exfiltration attack discovered in uBlock Origin. adblock-rust already prevents url(...) from appearing in :style(...) directives, but this attack involves opening and closing comments within the CSS to evade that mitigation.

antonok-edm commented

Partially fixed by 04c435a