1685137 - NoScript's DEFAULT preset blocks web-fonts.

Status: RESOLVED WONTFIX

(Firefox :: Extension Compatibility, defect)

Description

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Attachment: Screenshot

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:86.0) Gecko/20100101 Firefox/86.0 ID:20210104172545 with NoScript 11.1.17

If Javascript it not allowed for a domain Unicode characters are not displayed, at least when specified as content: in a ::before CSS declaration.

Here an example (also see the screenshot):
https://dict.leo.org/englisch-deutsch/script

content: "\f12e";

Giorgio, could you please have a look? Thanks.

Comment 1

[Giorgio Maone [:ma1]]

The problem is not NoScript preventing Unicode rendering (F12E is not a valid unicode character, anyway) but its DEFAULT preset blocking web fonts as a potential attack surface.
Since those (invalid) code points are rendered by the "icon" web-font, you cannot see them until you allow it to load, either by setting the site to TRUSTED or, in order to keep scripts disabled, just by switching from DEFAULT to CUSTOM and checking the "font" capability.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Oh I see. I didn't notice this option yet even that I'm using NoScript for a while. Enabling fonts for that site and keeping scripts blocked works just fine. Thanks.