3

I have a WordPress blog, and when I navigate to a particular path such as http://example.com/wp-content/themes/css/jquery-scrollbar.css?, I could see all the CSS code for the scroll bar.

My questions are:

  1. Is this a normal behaviour or is it a vulnerability?

  2. How to prevent the browser from showing the CSS?

  3. Is known CSS code a vulnerability?

TildalWave
  • 10,801
  • 11
  • 45
  • 84
MS Guy
  • 97
  • 9
  • 5
    I see there are a lot of downvotes here. I'm upvoting it because the user has a genuine question about security that's very easy to answer, even if he or she has a lot of misconceptions. We are all here to learn more about infosec... – Mark Buffalo Mar 03 '16 at 15:28

3 Answers3

13

Everything that is executed in the browser can be seen by the client, that is the nature of the Web. This includes HTML, javascript, and CSS. So, unless you put something confidential in a file that will be served by your browser, this is not an a vulnerability.

Edit: below is from @schroeder's comment

In addition, every single webpage can show the CSS code. You can download the CSS files, or open developer view to see and even manipulate the CSS code for your browser.

Neil Smithline
  • 14,621
  • 4
  • 38
  • 55
  • 1
    In addition, every single webpage can show the CSS code. You can download the CSS files, or open developer view to see and even manipulate the CSS code for your browser. – schroeder Mar 03 '16 at 07:36
5

Welcome to Security.SE. The issue that you described is not a security vulnerability. The reason is that JavaScript and CSS files must be viewable by the browser so that your website can function normally.

h4ckNinja
  • 3,006
  • 15
  • 24
-2

This is completely normal for a webpage without explicit security, it's even possible to copy a whole website if you have access to a bash terminal. The only real way to ensure no one has access to directories or files is to use a .htaccess file. These dictate which directories the user can view and not. For example, if you add an entry for www.foo.com/css then I head there, it'll return a 403.

Hope this helps.

TechnicalTophat
  • 99
  • 1