W3C home > Mailing lists > Public > whatwg@whatwg.org > May 2013

Re: [whatwg] font security on measureText

From: Anne van Kesteren <annevk@annevk.nl>
Date: Fri, 3 May 2013 10:23:54 +0100
Message-ID: <CADnb78iYvMAtXFuWY6ob3K54NTPoRtAEtRs_2JoSDnADdNSUTg@mail.gmail.com>
To: Rik Cabanier <cabanier@gmail.com>
Cc: WHATWG <whatwg@whatwg.org>, "public-canvas-api@w3.org" <public-canvas-api@w3.org>
On Thu, May 2, 2013 at 10:49 PM, Rik Cabanier <cabanier@gmail.com> wrote:
> Reading the Origin spec [1]:
> For fonts:
> The origin of a downloadable Web font is an alias to the origin of the
> absolute URL used to obtain the font (after any redirects). [CSSFONTS]
> The origin of a locally installed system font is an alias to the origin of
> the Document in which that font is being used.
> Fonts do not have an effective script origin.

1. That assumes tainted cross-origin as a fetching mode.
http://fetch.spec.whatwg.org/#concept-request-mode Whereas you assume
it uses CORS.

2. That really ought to be defined by CSS directly.

>> Part of the problem here is that CSS lacks a bunch of text.
> What do you mean by that? Is this underspecified?

CSS should say it fetches using mode CORS. That will result in a
either a response marked CORS-same-origin or a network error. Fonts
can be then be assumed to be safe as there is no way to obtain a
tainted font. (However, it is my understanding not all browsers are
aligned on this at the moment, so you might want to make sure that
happens first.)

Received on Friday, 3 May 2013 09:24:21 UTC

This archive was generated by hypermail 2.4.0 : Wednesday, 22 January 2020 16:59:58 UTC