Seems to work with external linked style sheets again:-

<link href="http://www.businessinfo.co.uk/labs/xss/binding.css" type=text/css rel=stylesheet media=all>

------------------------------------------------------------------------------------------------------------

"-/style=-=expression&#40&#47;&#42;WAFs..Evasion..Filters'/-/*&#39;,/**/alert(/People who say it cannot be done should not interrupt those who are doing it./)//&#41;;"

labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [www.businessinfo.co.uk]

Yup, reported here: [bugzilla.mozilla.org]

nEUrOO -- [rgaucher.info] -- [twitter.com]

@nEUrOO

Thanks for adding that, I forgot to add that exact reference. Shame on me. *Slaps self on head*

------------------------------------------------------------------------------------------------------------

"-/style=-=expression&#40&#47;&#42;WAFs..Evasion..Filters'/-/*&#39;,/**/alert(/People who say it cannot be done should not interrupt those who are doing it./)//&#41;;"

labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [www.businessinfo.co.uk]

Looks like it's not "again": we had been too much happy for the "fix" in Fx 3, overlooking that it didn't prevent 3rd party stylesheets from loading XBL from their domains.
The correct approach IMHO (and what I believe everybody including Jonas Sicking mistakenly assumend the previous "fix" was about) is NoScript's: blocking every cross-site XBL.
On a good.com page, even if a 3rd party stylesheet, let's say from evil.com, tries to load a XBL from the same evil.com domain (not cross-site in respect of the stylesheet), NoScript blocks the XBL anyway because its domain is different from the document's.

--
*hackademix.net*

There's a browser safer than Firefox... Firefox, with NoScript

@ma1

Very nice and that makes total sense. Shame FF doesn't do that by default.

------------------------------------------------------------------------------------------------------------

"-/style=-=expression&#40&#47;&#42;WAFs..Evasion..Filters'/-/*&#39;,/**/alert(/People who say it cannot be done should not interrupt those who are doing it./)//&#41;;"

labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [www.businessinfo.co.uk]