5

To avoid path-relative style sheet import vulnerabilities should I attach css file on my page using full path e.g.

<link href="http://mywebsite/style.css" type="text/css" rel="stylesheet" />

instead of 

<link href="style.css" type="text/css" rel="stylesheet" />

What do you think?

pnuts
  • 58,317
  • 11
  • 87
  • 139
user3896104
  • 107
  • 1
  • 4

1 Answers1

8

Just add a leading slash and make the path root-relative, rather than relative which this vulnerability relies on.
No need for the domain / scheme.

 <link rel="stylesheet" href="/style.css">
Adria
  • 8,651
  • 4
  • 37
  • 30