SECURITY: blacklist CSS var()