tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

1226400-1.html (1061B)


      1 <!DOCTYPE HTML>
      2 <html>
      3 <head>
      4 <title>FontFaceSet::Load crasher</title>
      5 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
      6 
      7 <style type="text/css">
      8 
      9 body {
     10  margin: 50px;
     11 }
     12 
     13 p {
     14  margin: 0;
     15  font-size: 300%;
     16 }
     17 
     18 </style>
     19 
     20 </head>
     21 <body>
     22 
     23 <p>This may crash on load...</p>
     24 
     25 <script>
     26 var scriptText = `
     27  var fontFaceSet = document.fonts;
     28  var link = document.createElement("link");
     29  link.onerror = link.onload = function() {
     30    fontFaceSet.load("12px foo");
     31  }
     32  link.rel = "stylesheet";
     33  link.href = "data:text/css,";
     34  document.body.appendChild(link);
     35 `;
     36 
     37 var styleText = `
     38  @font-face {
     39    font-family: foo;
     40    src: url("data:text/ttf,");
     41  }
     42 `;
     43 
     44 var ifr = document.createElement("iframe");
     45 document.body.appendChild(ifr);
     46 var style = ifr.contentDocument.createElement("style");
     47 style.textContent = styleText;
     48 ifr.contentDocument.body.appendChild(style);
     49 var script = ifr.contentDocument.createElement("script");
     50 script.textContent = scriptText;
     51 ifr.contentDocument.body.appendChild(script);
     52 ifr.remove();
     53 </script>
     54 </body>
     55 </html>