Risks of whitelisting background-image SafeList::ALLOWED_CSS_PROPERTIES

[puneet-sutar]

background-image is not included in SafeList::ALLOWED_CSS_PROPERTIES
I want to enable till to set background-image as a url.
What are potential risk and things I should consider while doing this.
My usecase is while using rails action text.
Thanks for the help.

[flavorjones]

Hi @puneet-sutar - attributes that cause loading of external assets via URLs/URIs are sanitized.

Please also note that Loofah doesn't have an opinion here, we're using the attributes from HTML5Lib; and #155 proposes using DomPurify. Both of these packages do not consider background-image to be safe.

I hope this helps?

[puneet-sutar]

@flavorjones That helps a lot and will help me make further decisions regarding my project.
Thanks a lot.