reddit/reddit — pull request #934 by andre-d (2013-12-19 05:22:38+00:00)
Title: cssfilter: Simplify css validation.

This branch uses tinycss to validate css rather than cssutils. tinycss is MUCH faster (about 10x or more faster) and does not care about the correctness of the css properties themselves. Tinycss simply validates that the css is valid, and allows us to validate URIs inside the css along with replace them with their static content url.

With this branch items like `bfafa: fffff;` are allowed through, however stuff like `background-image: url(http://google.ca)` are not. It validates for syntactically correct css to avoid any exploits while still allowing users to use whatever modern css (css3) people wish.

If there were selectors we wanted to ban, we could still do them in a blacklist rather than a whitelist.

I feel that this is a better future for us as validating for correct css is slow, requires maintaining, and can open up holes. With this approach we attempt to have syntactically correct css first, which is what we care (security wise) about more.

The main regression users will face involve urls with spaces in them. Currently we allow items like `url: (%% ff%%)` through, however, this new parser does not. In testing a large number (some) of these exist already. A script can be run to determine which subreddits will fail to validate.