Page MenuHomePhabricator

Gerrit API docs loads fonts from Google
Open, Needs TriagePublic

Description

https://gerrit.wikimedia.org/r/Documentation/rest-api.html loads fonts from fonts.googleapis.com.

Event Timeline

Nice find and indeed the source of the documentation pages have:

<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400,700">

AsciiDoctor has support for conditionals ifdef and ifndef described at:

They act against document attributes which can be set via the CLI option -a which I guess can be set via tools/bzl/asciidoc.bzl. We would then have to build our own war, but maybe we can change the default to use relative URL instead and have a build parameter to use googleapi.

Gerrit 3.10 comes with version 1.5.7 of org.asciidoctor:asciidoctorj, I have no idea whether it supports conditional.


Alternatively maybe we can set a content security policy to prevent the browser from downloading the custom css that loads fonts using style-src or maybe even default-src (though we have plugins fetching from integration.wikimedia.org or wmcloud.org`.

There's https://gerrit-review.googlesource.com/c/gerrit/+/436258 upstream. Although not much progress on pushing it forward.