GoogleChromeLabs / critters

🦔 A Webpack plugin to inline your critical CSS and lazy-load the rest.
https://npm.im/critters-webpack-plugin
Apache License 2.0
3.42k stars 108 forks source link

Prevent creating script tags from embedding stylesheets #156

Closed janicklas-ralph closed 6 months ago

janicklas-ralph commented 7 months ago

Critters loads external stylesheets and inlines them into the HTML via See these snippet on how we are loading and directly inlining the CSS Since there is no direct way to sanitize the CSS file contents, inlining them directly into the HTML can cause potential injection issue if the CSS contains closing style tag

This PR prevents creating script tags from embedding stylesheets