endtwist/kerning.js — pull request #13 by jacobq (2013-11-22 23:02:14+00:00)
Title: Same-origin security error

Version 0.2 of kerning.js does not correctly identify when a URL is "safe" (is on same origin and thus attempting to make an asynchronous HTTP request will not generate an error), which can cause errors to appear in the console that look like the following:

> XMLHttpRequest cannot load (my file).css. No 'Access-Control-Allow-Origin' header is
> present on the requested resource. Origin '(origin of my file)' is therefore not allowed
> access.

More details are listed in my commit notes (3c4a1543c26ab86b1c8d3a5c5d3fff4b879b05a9), but in brief, checking whether or not a URL is absolute (i.e. specifies a scheme) has two problems:
1 - It falsely assumes that protocol-relative (host+path)-absolute URLs such as //example.com/file are safe
2 - It falsely assumes that absolute URLs such as http://mysite/file are unsafe

I have attempted to correct both of these problems with my changes.