cloudhead/less.js — Issue #688: Worried about XSS (javascript injection)
Author: Clodo76
Created: 2012-03-07 12:52:38+00:00
State: open

I'm using less in a custom CMS, and i'm worried about XSS (javascript injection) of javascript in CSS.
Less allow javascript, like
```@mycolor: `alert('xss')`;```

I don't need and i don't want this possibility.
There is any kind of option to disable that?

Actually i forked and i added a "return" at top of this function:

```
//
// JavaScript code to be evaluated
//
// `window.location.href`
//
javascript: function () {
return; // MyQuickHack
var str, j = i, e;

if (input.charAt(j) === '~') { j++, e = true } // Escaped strings
if (input.charAt(j) !== '`') { return }

e && $('~');

if (str = $(/^`([^`]*)`/)) {
return new(tree.JavaScript)(str[1], i, e);
}
}
```