lotobo/font-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Release Font Tools 0.2.0
Verify / verify (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
zemion
2026-09-02 12:18:37 +02:00
parent 25ff321f2a
commit 873cf3c04b
39 changed files with 2431 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ARCHITECTURE.md
+22 -7
View File
@@ -1,12 +1,27 @@
# Architecture
`core/sfnt.ts` validates SFNT/WOFF headers and table boundaries before parsing.
`font.worker.ts` owns the opentype.js instance and the source bytes; the UI only
receives bounded serializable inspection records. Each load gets a new worker,
and an unresponsive operation is terminated after eight seconds. Subsetting is
a separate worker command that rebuilds a static outline font from requested
Unicode glyphs only after OS/2 restrictions are checked.
For TTC/OTC it accepts header versions 1.0 and 2.0, caps face count, validates
the complete offset array, uniqueness/alignment, each face signature and SFNT
directory, and the optional DSIG boundary. A selected face is reconstructed by
copying its bounded tables into a standalone SFNT directory with rewritten
offsets and checksum adjustment; those bytes exist only as a preview Blob and
are never offered as a round-trip-safe export.
For WOFF2 it validates the header, UIntBase128 directory, reconstructed SFNT
size, transform declarations and compressed-stream bounds before Fontkit's
browser build performs local Brotli/table decoding. This path needs neither
WebAssembly nor dynamic evaluation and therefore remains compatible with the
app's strict CSP. `font.worker.ts` owns the parser instance and source
bytes; the UI receives only bounded serializable inspection records, collection
face labels and the selected preview buffer, including variable axes and
GSUB/GPOS script, feature and lookup inventories. Each load gets a new worker,
and an unresponsive operation is terminated after eight seconds. Face switching
reuses that worker and updates its coverage/report model atomically. Subsetting
is a separate worker command that rebuilds a static outline font from requested
Unicode glyphs only after OS/2 restrictions are checked; WOFF2, variable and
collection sources are explicitly blocked.
React keeps the last successful inspection after errors. Font rendering occurs
in a scriptless sandboxed iframe. Relative assets and a same-origin service
React keeps the last successful inspection after errors. Font rendering and the
feature/language/direction comparison lab occur in a scriptless sandboxed iframe
using the browser's shaping engine. Relative assets and a same-origin service
worker support nested offline deployment.
docs/PRIVACY-SECURITY.md
+6
View File
@@ -6,6 +6,12 @@ downloads are the only output. Parsing uses strict size/table/expansion/glyph
caps, a disposable worker and a deadline. User metadata is rendered as text;
preview HTML is escaped and confined to a scriptless sandbox.
Collection face selection keeps the original TTC/OTC in its disposable worker.
Only the selected face is reconstructed into a bounded temporary Blob for the
sandboxed preview; it is revoked on replacement and is not exposed as an export.
TTC 2.0 DSIG boundaries are validated and reported, but signatures are not
cryptographically verified.
The OS/2 `fsType` field is technical metadata, not legal advice. Font Tools
blocks subsetting when it declares restricted embedding, no-subsetting or
bitmap-only embedding, but users must still comply with the actual licence.