title: What kind of HTMLPurifier settings do you use to purify CSS?
body: <p>I'm building an application which lets users input custom CSS for their own profiles (kinda like MySpace, Friendster, or Blogger).</p>
  
  <p>The problem is I'm having a hard time finding a way to purify XSS attacks through CSS. I tried using HTMLPurifier, but it doesn't work. One example:</p>
  
  <pre><code>html {
      expression: alert('xss');
  }
  
  body {
      background-color: #FFF;
  }
  </code></pre>
  
  <p>This would be allowed by HTMLPurifier.</p>
  
  <p>Are there any settings I need to use for HTMLPurifier to make this invalid?</p>
  
  <p>Thanks!</p>
  
  <p><strong>Update</strong><br>
  Is <strong><em>expression:</em></strong> the only way to push an exploit via CSS? If so, would a regular expression be more efficient than using HTMLPurifier?</p>