How can I disable Harfbuzz WASM in Chrome, Firefox and other systems?

[Lewiscowles1986]

Hi, Someone made https://fuglede.github.io/llama.ttf/ and it's been highlighted to my attention that your font library, ships supporting arbitrary code injection and execution on users machines.

I Was previously unaware of this, and would like to disable this; Ideally via an environment variable, and know if there are ways I can test the facility has been disabled; or if to your knowledge it ships disabled.

This is not a personal or professional slight; I think it's "cool" and thank you for sharing openly; but I just really don't want that feature if possible, and would like to experiment seeing how it effects my use of computers having the feature off.

[khaledhosny]

WASM shaper is not enabled by default.

[Lewiscowles1986]

Does this mean that Chrome and Firefox do not enable for use?

[behdad]

No platform enables it.

[dwt]

Since this shaping feature offers the ability to for example craft contracts that show different terms before and after they are signed - could you provide some links to the rationale for this feature, or rather how you planned to ever get this safe?

So far it seems that this whole shaping feature is impossible to secure?

[dwt]

@alerque Thinking about this more, maybe the alarm I'm feeling is more from the fact that it seems that the shaper is nondeterministic and or can be dependent on time. This seems to enable the attack of e.g. changing sums or terms on signed contract pdfs. (And I get that PDFs offer various other attack vectors that probably allow this).

So maybe I'm missing something, but is this actually the case? Can font rendering be non deterministic or dependent on the time? If WASM support is included, it seems highly likely that this is the case, but I haven't read the source code to understand this project.

Still, I think it important to note this particular feature of the shaper and would like to contribute by clarifying those points, so I would like some feedback if you guys will take it.

[alerque]

Once again, you're worried about this at the wrong level. If you are using a software rendering stack to view unshaped text content and relying an that for contract longevity then you are doing something else wrong. You have other problems than a possibly more flexible shaper system that isn't even enabled anywhere.

Properly generated PDFs should be already typeset. That means what you are viewing in a PDF has already been shaped and the output of the shaper captured. PDFs are a bizarre format with many possible ways of encoding things and yes you can make PDFs with unshaped content in them that would be subject to the viewers text handling software stack. If you are archiving contracts you need to make sure you are using PDFs where that is not the case and each glyph or grapheme is already resolved from the input text and it's position fixed in the output. It shouldn't depend on system fonts, and any embeded fonts should be used just for glyph shapes where at most anything the viewer does is word and character at a time, not whole lines or paragraphs. And of course you should checksum and/or sign the file. If archiving is really a big deal a rasterized version (possible to do with embeded images in the PDF) that is likewise checksummed will serve you much better.