Is the style considered harmful?

Question

We have code that removes “dangerous” attributes and tags from HTML. I noticed that it styleis on the list of "dangerous" attributes. What is the risk of this attribute?

Answer 1

You can make things invisible or otherwise very deceptive using style sheets. For example, you can put a giant invisible anchor link on the entire page, so that when a user clicks on something, he goes to an identical page on a server in Russia.

Answer 2

In IE, you can enable @behaviorsit where you can download small Javascripts.

CSS3 , .

Answer 3

Here's an example error in MediaWiki that creates a vulnerability based on inline style attributes.