Re:CSS Based Attack fontface
by khaled on Monday November 02, 2015 @11:39AM
(#10492871)
I don’t see how this would work. When the browser renders an “ff” ligature, it does not do so by converting every “ff” in the input into U+FB00, as such it will never use this font unless the user input actually contains U+FB00 which is unlikely.
[ Parent
| on HN ]