What’s blocked
In CSS values
Inline style="..." rejects the entire declaration if it contains any of these.
<style> blocks scrub the scripting vectors but (unlike inline styles) allow url(...).
| Pattern | What it blocks |
|---|---|
expression\s*\( | CSS expression() (legacy IE scripting) |
javascript\s*: | javascript: URLs |
vbscript\s*: | vbscript: URLs |
-moz-binding | -moz-binding (XBL scripting) |
behavior\s*: | behavior: (IE behaviors) |
url\s*\( | url(...) — in inline style= only; allowed in <style> blocks for same-origin resources |
In <style> blocks — at-rules
- Scoped & kept:
@container·@layer·@media·@supports— recursed into and prefixed with.hw-parser-output. - Kept verbatim:
-webkit-keyframes·keyframes·page— emitted unscoped. - Dropped:
@import,@font-face,@charset,@namespace, and any other at-rule.
Theme-aware colors (dark mode)
darkstyle="…"attribute — allowed whereverstyleis; its CSS applies only in dark mode (Appearance → Dark, or System on a dark OS) and overrides the element’sstylethere. Same CSS safety rules asstyle.@dark { … }at-rule in<style>blocks — the rules inside apply only in dark mode. Nests with@mediain either order.- Theme tokens usable in any of the three:
var(--wiki-color)(theme text),var(--wiki-bg)(page background),var(--wiki-surface)(raised card fill),var(--wiki-muted),var(--wiki-border). They resolve per theme, so markup that uses them needs no dark override at all. - A background defined only for light keeps its light color in dark — add a
darkstyle(or@darkrule) when a dark variant is wanted.