Is the security check in fillText/strokeText useful?

[domenic]

https://html.spec.whatwg.org/multipage/scripting.html#dom-context-2d-stroketext

If the text preparation algorithm used a font that has an origin that is not the same as the origin specified by the entry settings object (even if "using a font" means just checking if that font has a particular glyph in it before falling back to another font), then set the CanvasRenderingContext2D's origin-clean flag to false.

I came across this as part of #1431. It looks like this is not implemented in any open-source browser, from what I can tell by code inspection. @bzbarsky in an offline email said

I'm not sure what this is trying to protect against. Font loads are subject to CORS to start with, so as far as I can tell what this is trying to do is prevent you from exfiltrating, via canvas, the glyphs of a font that already opted into allowing you to use it (via CORS). I'm 99% sure Gecko doesn't try to do anything like this, and I'm not sure it's useful to do it, honestly. Do other UAs do this sort of check?

The spec source code has the comment

   <!-- because fonts could be considered sensitive material, I guess; and because that
   sensitivity could extend to whether or not a particular glyph is in the font in the first place.
   -->

Should we remove this check from the spec?

[bzbarsky]

Here's the way I see it: if you managed to load the font such that you can use it, that means that you can load the font file using XHR (because font loads are already subject to CORS). At that point, you can just extract glyph information from it yourself so there is no meaningful security thing going on here.

Am I missing something?

[domenic]

If https://developer.microsoft.com/en-us/microsoft-edge/platform/status/crossdomainfontloading means what I think it means, I guess fonts are not subject to CORS in Safari and Mobile IE? It looks like Chrome made them subject to CORS in Chrome 37. Hmm.

[bzbarsky]

I'm not sure what the status of this stuff is in IE. Safari has long resisted implementing the CORS stuff there. I agree that UAs that don't follow the CSS spec for @font-face may need an extra mechanism to prevent leaking information via canvas. The ones that do follow the CSS spec don't need that.

[junov]

Drive-by comment: The only outstanding security/privacy issue I can think of with canvas text rendering is that it can be used for fingerprinting. But that has more to do with local fonts than with cross-origin fonts (you can sniff which fonts are installed on the client OS). I don't think we are about to start tainting canvases that use local fonts...

[zcorpan]

FYI I think when this was added to the spec, only Gecko used CORS for fonts and other browsers didn't. Presto may have implemented the tainting, not sure. :-)