Allow CSS in comments again

Oct 23, 2010 09:55


Title
Allow CSS in comments again

Short, concise description of the idea
It's not possible to style comments by using the "style" attribute of HTML tags. This ability should be reinstated.

Full description of the idea
I'm told that this change was made because inline CSS was abused by spam accounts. I don't know the nature of the abuse but I imagine that it relies on particular kinds of CSS (perhaps "display: none" or absolute positioning).

It would be good if at least some CSS were allowed - either by stripping out known bad/possibly-abusive CSS tags or by allowing known good/harmless CSS tags.

Presumably, the "whitelist" approach will be easier to implement securely since it doesn't depend on knowing what spammers might come up with in the future.
An ordered list of benefits
  • Users will be able to style their comments again, by making portions larger or smaller, coloured, with different backgrounds, with a specific font, etc. They will be able to be more expressive and creative.
  • Users can continue their styling habits (depending on which parts of CSS will be allowed).
An ordered list of problems/issues involved
  • Selectively allowing CSS will require a CSS parser to be written (or obtained). This will obviously have to be robust in the face of illegal CSS and various tricks people use to escape "bad" tags. However, I believe that such a parser already exists in part because certain parts of CSS (such as "expression") were already filtered out, so it may be possible to build on that.
  • This parser will have to be tested and maintained.
  • Some people find _any_ styled text annoying or unreadable. (Though catering to this would, strictly, also entail stripping "b, i, strong, em, cite, font, sup, sub, big, small" HTML tags; possibly also "code, tt, pre" and others, depending on the sensitivities of such users.)
  • Spammers may use allowed CSS to be annoying even if they can't use it to hide their links any more.

html cleaner, markup, comments, § no status

Previous post Next post
Up