Bug 1416808 - Add "$XDG_DATA_(HOME|DIRS)"/fonts to the sandbox whitelist. r=jld

MozReview-Commit-ID: DwwltKQg8x4

--HG--
extra : rebase_source : e92b60e320bb26e66bfb38039f141ec83a34fff7

security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp

@@ -281,6 +281,22 @@ SandboxBrokerPolicyFactory::SandboxBrokerPolicyFactory()
     policy->AddDir(rdonly, PromiseFlatCString(path).get());
   }
 
+  // Allow fonts subdir in XDG_DATA_HOME
+  nsAutoCString xdgDataHome(PR_GetEnv("XDG_DATA_HOME"));
+  if (!xdgDataHome.IsEmpty()) {
+    nsAutoCString fontPath(xdgDataHome);
+    fontPath.Append("/fonts");
+    policy->AddDir(rdonly, PromiseFlatCString(fontPath).get());
+  }
+
+  // Any font subdirs in XDG_DATA_DIRS
+  nsAutoCString xdgDataDirs(PR_GetEnv("XDG_DATA_DIRS"));
+  for (const auto& path : xdgDataDirs.Split(':')) {
+    nsAutoCString fontPath(path);
+    fontPath.Append("/fonts");
+    policy->AddDir(rdonly, PromiseFlatCString(fontPath).get());
+  }
+
   // Extra configuration dirs in the homedir that we want to allow read
   // access to.
   mozilla::Array<const char*, 3> extraConfDirs = {