问题
To avoid path-relative style sheet import vulnerabilities should I attach css file on my page using full path e.g.
<link href="http://mywebsite/style.css" type="text/css" rel="stylesheet" />
instead of
<link href="style.css" type="text/css" rel="stylesheet" />
What do you think?
回答1:
Just add a leading slash and make the path root-relative, rather than relative which this vulnerability relies on.
No need for the domain / scheme.
<link rel="stylesheet" href="/style.css">
来源：https://stackoverflow.com/questions/29260013/path-relative-style-sheet-import-vulnerabilities