1423602 - Resource timing violates SOP for font files loaded under "no-cors" CSS

Status: NEW

(Core :: Layout, enhancement, P3)

Description

[Jonathan Watt [:jwatt]]

Spinning this off from bug 1180145. Style sheets that are loaded by no-cors parent style sheets are now hidden from resource timing reporting. Font files loaded under a no-cors style sheet are not hidden yet though.

There's an exception in dom/tests/mochitest/general/test_resource_timing_nocors.html to ignore the timing entry for the font file for now.

For now I'll leave the sec keywords in place as they were over in bug 1180145. Probably leaking font file URLs isn't as big a concern as leaking style sheet URLs though.

Comment 1

[Daniel Veditz [:dveditz]]

Jet: please find appropriate folks to work on these security bugs.

Comment 2

[Jonathan Watt [:jwatt]]

(In reply to Jonathan Watt [:jwatt] (needinfo? me) from comment #0)
> For now I'll leave the sec keywords in place as they were over in bug
> 1180145. Probably leaking font file URLs isn't as big a concern as leaking
> style sheet URLs though.

I should have been clearer. I don't think this is sec-high, but it's unclear to me that I should be the one to make the decision to change that flag. I would like someone from the sec team to justify why (or at least state) that they think pages being able to see the URLs of the font files being loading is likely to be a concern in practice. A specific example would be helpful.

It's not that I'm adverse to fixing this, but simply that it seems to be low priority to me.

Comment 3

[Frederik Braun [:freddy]]

I think I agree with Jonathan here.

SOP violations are bad generally, but a resource timing attack for non-cors *fonts* are so much an edge case, that it's hard to  come up with a scenario where it's really bad.
Given the wideness of the world wide web, there's probably a web page that is affected and for which this is bad.
But at this point, I'd be surprised if we found it :)

Comment 4

[Anne (:annevk)]

Note, it's not non-cors fonts. It's font URLs loaded from a non-cors cross-origin stylesheet. If fonts end up with user-specific URLs (e.g., for copyright reasons) this would be used to determine the user.

Comment 5

[Yoav Weiss]

I'm trying to land a related WPT[1] and it seems like it sometimes passes, but mostly fails[2].

[1] https://github.com/web-platform-tests/wpt/pull/9307
[2] https://tools.taskcluster.net/groups/KSZfI4TBRc6KDrmK5PmCEA/tasks/dFuzylSpS3W7pbsQFetv0Q/runs/0/logs/public%2Flogs%2Flive.log

Comment 6

[Yoav Weiss]

Flakiness was eliminated with a longer timeout, as the passes were just cases were the entry wasn't yet added.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.

Comment 8

[likexef]

Attachment: Error in this Bug