Font Content Security Policy directive with Forge Custom UI

Jira Development Jira Cloud
,
1

I am developing a plugin by Forge ( Custom UI)
I import the third library UI.
I see the error belows:

hasRelativeStackingContext.js:22 Refused to load the font 'data:font/ttf;base64,AA*************
because it violates the following Content Security Policy directive: "font-src 'self'".

I add the meta tag in a header in the file “index.html” but it still not working.

<meta http-equiv="Content-Security-Policy" content="font-src 'self' data:; img-src 'self' data:; default-src 'self'">

Screenshot_16
Screenshot_161277×64 6.84 KB

2

Hi @MARINAHDAVILA

You may want to take a look at this page: https://developer.atlassian.com/platform/forge/add-content-security-and-egress-controls/

You could try adding permissions content policy that way.

Kind regards

3

Hi @linklefebvre
I checked but it only for css and script. It dont have permission for font.

4

Hi @MARINAHDAVILA how do you fix the font-src issue? I got the same issue today.

5

Hi @MARINAHDAVILA and @YY1,

how did you fix the font-src issue?

6

not yet. limited document or guide to direct me, so I gave it up.

7

any updates on this issue ? I can setup external CSPs for fonts but it still doesn’t work for data: URLs

8

I’ve found a solution by allowing all external fonts. Just add it to your manifest.yml:

permissions:
  external:
    fonts:
      - '*'
1 Like
9

Hi @AndreiPisklenov ,

Unfortunately, * doesn’t work for base64 encoded fonts.

Refused to load the font 'data:application/x-font-ttf;charset=utf-8;base64,............' because it violates the following Content Security Policy directive: "font-src 'self'".
10

I haven’t checked it, but something like “unsafe-inline” for “fonts” could assist:

permissions:
  content:
    fonts:
      - unsafe-inline

or

permissions:
  content:
    styles:
      - 'unsafe-inline'
11

It is the second one. I had already permissions/content/styles/unsafe-inline, but unfortunately it doesn’t work. base64 encoded fonts are not supported. I really appreciate if you could add your votes to [FRGE-578] Support for base64 encoded fonts - Ecosystem Jira (atlassian.net).