"application/font” data in base64 format

[david001]

As I read here: https://trac.torproject.org/projects/tor/ticket/33430 NoScript doesn't block all fonts, although it should IMHO. Shouldn't NoScript avoid using such fonts?


BTW: I cannot post here without activating JS and solve a lot of captchas. Something, that should be changed too...

[skriptimaahinen]

Can confirm. Couple more test cases:

https://www.mediaevent.de/font-in-css-einbetten/ - If the large "Pacifico" text (scroll down to midway of the page) is in beautiful cursive, the data-fonts are not blocked.

https://yle.fi/uutiset - If the blue nav-bar on top of the page has "location marker" on the left side of "Paikallisuutiset", the data-fonts are not blocked.

The problem is that "font-src http: https:" is not being added to the CSP-header. Looks like "font" is missing from "types" in CapsCSP.js?

[Giorgio Maone]

The problem is that "font-src http: https:" is not being added to the CSP-header. Looks like "font" is missing from "types" in CapsCSP.js?

Yes, it is. Fixing that in next release, thanks.

[Giorgio Maone]

Please check latest dev build, thanks.
v 11.0.15rc1
============================================================
x Fixed CapsCSP bug allowing data: URLs to bypass font
blocking (thanks dcent and skriptimaahinen)
x [XSS] Prevent DOS detection from being triggered for
already aborted requests (thanks therube)