[wp-trac] [WordPress Trac] #57156: Icons missing in iOS Lockdown Mode (was: icons on mobile devices (WordPress, and numerous other third party applications all have broken "squares" on all of these products.))

[WordPress Trac]

#57156: Icons missing in iOS Lockdown Mode
-------------------------------------+-------------------------------------
 Reporter:  noexitorescape           |       Owner:  (none)
     Type:  defect (bug)             |      Status:  new
 Priority:  normal                   |   Milestone:  Awaiting Review
Component:  Administration           |     Version:
 Severity:  normal                   |  Resolution:
 Keywords:  reporter-feedback        |     Focuses:  ui, administration,
  needs-testing                      |  privacy
-------------------------------------+-------------------------------------
Changes (by sabernhardt):

 * focuses:  ui => ui, administration, privacy
 * component:  External Libraries => Administration
 * version:  6.1.1 =>
 * keywords:   => reporter-feedback needs-testing


Old description:

> Have you made any progress on a back-end workaround or better explanation
> for why all of the icons on mobile devices (WordPress, and numerous other
> third party applications all have broken "squares" on all of these
> products.)
>
> The superficial cause is ios16 in lockdown mode. But its breaking all of
> our products including yours.
>
> It will get worse when MacOS Ventura gets released into GA and has the
> same behavior.
>
> I suspect it is a result of loading external JS in the https zone, such
> as previous problems with XSS and mixed content that have broken other
> web technologies in the past.
>
> There is a workaround called "How to exclude apps or websites from
> Lockdown Mode" at the URL below. Best,  https://support.apple.com/en-
> in/HT212650

New description:

 Have you made any progress on a back-end workaround or better explanation
 for why all of the icons on mobile devices (WordPress, and numerous other
 third party applications) all have broken "squares" on all of these
 products.

 The superficial cause is iOS16 in lockdown mode. But it's breaking all of
 our products including yours.

 It will get worse when MacOS Ventura gets released into GA and has the
 same behavior.

 I suspect it is a result of loading external JS in the https zone, such as
 previous problems with XSS and mixed content that have broken other web
 technologies in the past.

 There is a workaround called "How to exclude apps or websites from
 Lockdown Mode" at the URL below. Best,  https://support.apple.com/en-
 in/HT212650

--

Comment:

 Hi and thanks for the report!

 Apple's [https://support.apple.com/en-in/HT212650 Lockdown Mode] article
 states:
 > web fonts might not be displayed, and images might be replaced with a
 missing image icon.

 Lockdown Mode is intentionally very strict, and the screenshot seems to
 indicate that the "dashicons" font is blocked.

 I expect this could cause some problems with the login pages' password
 visibility button and places within the admin back-end, too.

 Of course, the admin toolbar likely has the biggest problem without the
 icon font. Its links show only the icons on smaller screens, and the
 WordPress logo link is icon-only whenever it appears (screens wider than
 600 pixels).

 Could you (or someone else) check whether Lockdown Mode also bans inline
 SVG images? One place to find them is the admin Dashboard, in the welcome
 widget, where each paragraph has an icon SVG before it. The block editor
 has many inline SVGs, too.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/57156#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform