Affecting @-moz-document url-prefix() CSS hack will no longer work

Published: | Categories: CSS, Privacy & Security

Description

The @-moz-document CSS at-rule has been disabled with Firefox 61 to mitigate the risk of CSS injection attacks, but the empty url-prefix function is still being parsed because it’s known to be used as a CSS hack targeting Firefox.

/* This only works with Firefox */
@-moz-document url-prefix() {
  #prices td {
    height: 100%;
  }
}

Given the security concerns, the remaining support will also be dropped in the near future anyway once major compatibility issues are solved. If you’re using this hack to work around a specific layout bug in Firefox, please report the issue to Bugzilla or let us know.

References