Say there is a situation where site a is directly linking a font file

ie https://www.example.com/FONT.woff2

from site b.

Would it be possible for someone to make a URL rewrite rule to point to a malicious file then someone who would visit site a would download the malicious file instead of the intended one?

for example, the user would hit site a, site b would have a rewrite rule for the specified font so when that is called it would redirect to https://www.example.com/MALICIOUS.JS instead.

  • it wouldn't matter if it did redirect to something bad, the font just wouldn't work; there's no way to run code from a font, so there's no risk from bad code. your risk is the font not loading.
    – dandavis
    Commented Sep 28, 2017 at 6:48
  • Rewrite rule? If you hotlink https://siteb.example.com/FONT.woff2, site b can serve whatever it wants at that URL. Why would it need a rewrite rule specifically?
    – Ajedi32
    Commented Oct 3, 2017 at 13:27

2 Answers 2


Including resources from a third party site means that you include resources in your page where you have no control about the content of the resource. Thus, even if the content was the expected one at the time you've added the link it can change whenever it suites the owner of the site - or somebody which hacked the site. This is not restricted to a redirect as you envision but the third party site can serve a different content in the first place.

The impact of this depends on what kind of resources you hotlink. If you include JavaScript from a third party site (like done a lot when offering the ability to share on social media) then the third party can essentially fully control what gets displayed to the visitor of your site but also embed a keylogger in your page or similar. Including fonts might be a problem too since malicious fonts could be used multiple times in the past to use bugs in the browser or OS and execute malware.

And while replacing images will usually not result in unwanted code execution (unless another bug in image processing is exploited) you can get instead an image you don't actually want on your site. For example some sites punish unwanted hotlinking with "special" images but it might also be more harmful be used for phishing attacks as seen in this answer. See also this question for more ideas.

Note that the replaced resource still needs to match the expected type of resource. This means if the browser expects a font and the attacker serves a JavaScript file instead it will not be executed. But if the attacker serves a malicious font in this case it will be used.

For some types of resources and for some browsers subresource integrity will help to detect if third party resources gets changed and not load the resource in this case. But, this currently works mainly with script and css and for example not with fonts or images. And, it works currently only with Chrome, Opera, Firefox and Safari.

  • but what's the harm? (danger)
    – dandavis
    Commented Sep 28, 2017 at 6:50
  • @dandavis: see edit Commented Sep 28, 2017 at 6:54
  • 2
    @NooBskie: If the browser expects a font and gets a Javascript instead it will not execute the Javascript. But if it gets a font and gets a malicious font it will try to use it. Commented Sep 28, 2017 at 6:56
  • 1
    I think subresource integrity is worth mentioning here. Commented Sep 28, 2017 at 14:06
  • 1
    @DanielGrover: you are right. I've edited the question a bit and also added a link to your answer. Commented Sep 28, 2017 at 16:15

There are many potential problems. If you are including javascript, they can do a lot of bad things, like keylogging or completely change the webpage to display a phishing page, or download malware, or something like that.

Even with just images, the user's privacy will be compromised because they will know the IP address and referrer. Even worse, they can include an http basic authentication requirement to the image and attempt to phish for credentials. basic authentication phishing with images https://securitycafe.ro/2017/09/06/phishy-basic-authentication-prompts/

  • scary, but what's this to do with a font resource anyway?
    – dandavis
    Commented Sep 28, 2017 at 20:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .