1428001 - Web font not applied when the page gets loaded via file://

Status: NEW

(Core :: Graphics: Text, defect, P3)

Description

[Tobi Reif]

Attachment: grid.zip

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20171226083017

Steps to reproduce:

Load file:///path/to/grid.html .


Actual results:

The web font doesn't get applied.


Expected results:

The web font should get applied.

It gets applied when I load it from the server:
https://tobireif.com/demos/grid/

Works locally and remotely in eg Chrome.

Comment 1

[Gingerbread Man]

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
20180104100157

You didn't include the font in your testcase. I got a copy of it [1], placed it in the same folder, changed url(../../fonts/frankfurter/Frankfurter.woff) format("woff"); to url(Frankfurter.woff) format("woff"); and it works.

[1] https://www.fjallraven.fi/skin/frontend/carbon/fjallraven/fonts/frankfurter.woff

Comment 2

[Tobi Reif]

Thanks for investigating!

I need to leave the font where it is - I can't move it into the same directory.

It works in Chrome and Safari: Both load the font (which is in ../../fonts/frankfurter/ ) when I load the page using file:///path/to/grid.html .

I hope this issue can get fixed in Firefox.

Comment 3

[Gingerbread Man]

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
20180104220114

---

downloadable font: download failed (font-family: "Frankfurter" style:normal weight:normal stretch:normal src index:0): bad URI or cross-site access not allowed source: file:///D:/Grandpappy%20folder/fonts/frankfurter/Frankfurter.woff2  unknown:10:11

downloadable font: download failed (font-family: "Frankfurter" style:normal weight:normal stretch:normal src index:1): bad URI or cross-site access not allowed source: file:///D:/Grandpappy%20folder/fonts/frankfurter/Frankfurter.woff  unknown:10:11

---

The first error is expected, since I couldn't find a copy of the woff2 file. But the woff file is definitely in the right location: if I go to the URL from the error in the browser console, I'm prompted to download it.

I'm confirming this because I can reproduce the issue, I couldn't find any dupes, and it works as expected in Vivaldi, IE and Edge. That being said, this could turn out to be intended behavior for Firefox's security sandbox. Even a Firefox feature like userContent.css is only allowed to load local files from certain locations (bug 1422570).

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

I'm doubtful this is sandbox related.

Can you try with running Firefox with the environment variable |MOZ_DISABLE_CONTENT_SANDBOX| set to |1| and see if it reproduces?

Comment 5

[Tobi Reif]

On Mac OS, in Terminal.app, I entered this:

$ MOZ_DISABLE_CONTENT_SANDBOX=1; /Applications/Firefox.app/Contents/MacOS/firefox

Then in the opened Firefox I entered this:

file:///path/to/grid.html

The font doesn't get loaded/applied.

And in the terminal I got this:

2018-01-05 16:41:10.407 plugin-container[884:10177] *** CFMessagePort: bootstrap_register(): failed 1100 (0x44c) 'Permission denied', port = 0x15043, name = 'com.apple.tsm.portname'
See /usr/include/servers/bootstrap_defs.h for the error codes.
2018-01-05 16:41:11.396 plugin-container[886:10304] *** CFMessagePort: bootstrap_register(): failed 1100 (0x44c) 'Permission denied', port = 0x15403, name = 'com.apple.tsm.portname'
See /usr/include/servers/bootstrap_defs.h for the error codes.
[at this point in time I entered the URL]
2018-01-05 16:41:23.420 plugin-container[890:10468] *** CFMessagePort: bootstrap_register(): failed 1100 (0x44c) 'Permission denied', port = 0x14c3f, name = 'com.apple.tsm.portname'
See /usr/include/servers/bootstrap_defs.h for the error codes.

$ stat /usr/include/servers/bootstrap_defs.h
stat: /usr/include/servers/bootstrap_defs.h: stat: No such file or directory

Comment 6

[Alex Gaynor [:Alex_Gaynor]]

Ok, this confirms that it's not sandboxing related.

Comment 7

[Tobi Reif]

For local testing, use the attached zip, plus the font files from https://tobireif.com/demos/grid/ (placed locally at the location refd in the CSS in the zip).

Comment 8

[Jonathan Kew [:jfkthame]]

This sounds like expected behavior.

A page loaded from a file:/// url can't access fonts from further up the filesystem hierarchy (paths like ../../font.ttf), because they're considered to be a different origin.

You can relax this restriction by setting security.fileuri.strict_origin_policy to false in about:config.