[whatwg] font security on measureText

[Boris Zbarsky]

On 5/3/13 5:23 AM, Anne van Kesteren wrote:
> On Thu, May 2, 2013 at 10:49 PM, Rik Cabanier <cabanier at gmail.com> wrote:
>> What do you mean by that? Is this underspecified?
>
> CSS should say it fetches using mode CORS. That will result in a
> either a response marked CORS-same-origin or a network error. Fonts
> can be then be assumed to be safe as there is no way to obtain a
> tainted font. (However, it is my understanding not all browsers are
> aligned on this at the moment, so you might want to make sure that
> happens first.)

The text at 
http://dev.w3.org/csswg/css-fonts/#default-same-origin-restriction and 
http://dev.w3.org/csswg/css-fonts/#allowing-cross-origin-font-loading 
predates your introduction of the mode values, but clearly corresponds 
to the "CORS" mode, no?

And while browsers are not aligned yet, they did plan to align last I 
heard, in that their representatives in the WG had agreed to the above text.

Of course it's possible some of the browsers involved are just planning 
to ignore the spec altogether without bothering to argue to get it 
changed to what they think is the right thing.

-Boris