1568177 - Regression: CORS Same-origin policy blocks fonts when viewing local file

Status: RESOLVED DUPLICATE of bug 1565942

(Core :: DOM: Security, defect)

Description

[Leon]

Attachment: cors-blocked-fonts.zip

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

Create HTML file with some text. Style that text using a CSS @font-face pointing to a font in the same directory.

Please see the attached cors-blocked-fonts.zip file for an example (remember to extract the zip before viewing).

Opening the index.html file in Chrome and Firefox will show that Chrome is displaying the appropriate font however Firefox is not.

Opening the console in Firefox shows
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at file:///path-to-font/font-name.ttf. (Reason: CORS request not http).

Actual results:

The font is not applied to the text.

I suspect this is a regression caused by #1558299
https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11730

Expected results:

The text should have the font style applied.