Local rustdocs generate cross-origin errors trying to load fonts in Firefox

[luser]

Loading the locally installed copy of the standard library docs in Firefox I see errors in the console about loading fonts:

downloadable font: download failed (font-family: "Source Serif Pro" style:normal weight:normal stretch:normal src index:1): bad URI or cross-site access not allowed source: file:///C:/Users/Ted%20Mielczarek/.multirust/toolchains/stable-x86_64-pc-windows-msvc/share/doc/rust/html/SourceSerifPro-Regular.woff

This is because Firefox implements a strict same-origin policy for file: URLs: https://developer.mozilla.org/en-US/docs/Same-origin_policy_for_file:_URIs

...and web fonts follow the same-origin policy, so a html page loaded from a file: URL can't load a web font from a parent directory.

/cc @Ms2ger

[GuillaumeGomez]

Please take a look at #34702 to see if it solved your issue.

[ollie27]

This might be a bug in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=760436.

[GuillaumeGomez]

It's because of firefox. But not sure if this is a bug.

[Ms2ger]

Note that that bug is marked as invalid.

[QuietMisdreavus]

Triage: still a problem. Reading the discussion in the bugzilla link that @ollie27 linked, it may be deliberate:

I believe this is working as designed. AIUI, the issue here is that for a page loaded from a file:// URI, only files in (or below) the same directory of the filesystem are considered to be "same origin", and so putting the font in a different subtree (../font/) means it will be blocked by security policy restrictions.

You can relax this by setting security.fileuri.strict_origin_policy to false in about:config, but as this gives the page access to your entire local filesystem, it's something to be used with caution.

If that's the case, i'm not totally sure this is a problem we can fix without asking Firefox to adopt a looser same-origin policy for file:// URLs.

[jonhoo]

Looking back, this might be part of the reason I wanted #54772. I was opening docs locally in Firefox, and kept seeing the awful fonts that the browser falls back to when it fails to load the rustdoc fonts. I think the situation would be significantly improved (though not entirely fixed) by making the font stacks be only the loaded font + the font style. So, for example, today we have

body {
    font: 16px/1.4 "Source Serif Pro",Georgia,Times,"Times New Roman",serif;
}

The page looks significantly better with just

body {
    font: 16px/1.4 "Source Serif Pro",serif;
}

I don't know why those other intermediate font overrides are even there?

[jonhoo]

From #docs on Discord:

@killercup: another fix for the font issue is to inline the font in the css (by using a data url, i.e. encode it as base64). not sure why that's not suggested in the issue

[medwards]

For myself this issue is caused by the fact that I go directly to the API search page (file:///home/user/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/rust/html/std/index.html?search=).

In this case the fonts are actually one folder above my current folder which violates the rule outlined by jfkthame in the mozilla bug:

By default, only files in or under the same directory are considered same-origin for "file:" URLs, so your "../i/Pecita.otf" is not allowed to load.

To verify this I copied the fonts into the std folder and prepended std/ to the font urls in rustdoc.css. This fixed it for me.

Edit: Verified that this affects rustup doc --std on my machine and that my workaround also applies.

[luser]

This seems to work fine now in Firefox 69. For reference it looks like this behavior was changed in Firefox in https://bugzilla.mozilla.org/show_bug.cgi?id=1565942, which landed in Firefox 69 and was backported to 68.0.2.

[GuillaumeGomez]

Awesome! I guess we can close it then.