1388606 - data:font same-origin-check test case is not written correctly

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Henry Chang [:hchang]]

Current data:font same-origin check relies on accessing document.fonts.size [1] but I don't see any restriction on that. See my test page below:

http://elefant.github.io/data-uri/font.html

The correct way to test it should be something like cross-domain @font-face in css.

[1] http://searchfox.org/mozilla-central/rev/0f16d437cce97733c6678d29982a6bcad49f817b/dom/base/test/test_data_uri.html#88

Comment 1

[Henry Chang [:hchang]]

http://searchfox.org/mozilla-central/rev/0f16d437cce97733c6678d29982a6bcad49f817b/dom/base/nsDocument.cpp#13187
http://searchfox.org/mozilla-central/source/layout/style/FontFaceSet.cpp#575

Our implementation also doesn't seem to enforce principal restriction on that.

Comment 2

[Henry Chang [:hchang]]

Attachment: Bug 1388606 - Test case for ensuring data:font is treated same-origin.

We try to load a data:font and apply to some text in the test case. In case
data:font is treated different origin, the font will not load and the
test would fail.

Review commit: https://reviewboard.mozilla.org/r/166466/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/166466/

Comment 3

[Henry Chang [:hchang]]

Comment on attachment 8895279 [details]
Bug 1388606 - Test case for ensuring data:font is treated same-origin.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/166466/diff/1-2/

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8895279 [details]
Bug 1388606 - Test case for ensuring data:font is treated same-origin.

https://reviewboard.mozilla.org/r/166466/#review171618

looks good to me, thanks. r=ckerschb

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5bf5f9a8b4a7
Test case for ensuring data:font is treated same-origin. r=ckerschb

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5bf5f9a8b4a7