[Bug]: Custom fonts with absolute src paths are not loaded due to incorrect path resolution

[hades343]

Demo URL

No response

What happened?

There's an issue when using custom fonts with absolute src paths. The problem arises in the resolveFontFiles function, where the absolute root is joined with the absolute source, leading to incorrect path resolution. This prevents the plugin from loading custom fonts specified with absolute paths.

unplugin-fonts/src/loaders/custom.ts

Lines 83 to 84 in 8bc315c

	for (const source of sources) {
	const results = fg.sync(join(root, source), { absolute: true, cwd: root, onlyFiles: true })

Reproduction steps

Unfonts({
  custom: {
    families: [
      {
        name: 'Geist',
        src: path.resolve(...),  // any absolute path
      },
    ],
    injectTo: 'head',
  },
});

Relevant log output

No error is thrown, the files are simply not found.

What browsers are you seeing the problem on?

Other

What is your operating system?

Windows

[stafyniaksacha]

Allowing to read files from outside the vite root dir may lead to security issues, it should be combined with https://vite.dev/config/server-options.html#server-fs-allow

Can you explain your use case ?

[hades343]

Thanks for raising this. In our setup, we're using a turborepo where our base vite configuration lives in packages/vite. Since all apps share the same custom fonts (Geist and Geist Mono), we decided to store them centrally instead of duplicating them in each app directory. We're aware of the potential security issues, and we consider this safe in our context. We can certainly combine this with server.fs.allow as suggested.

[segevfiner]

Related to #69

[vojty]

I've also hit this issue. The problematic line is here https://github.com/vojty/unplugin-fonts/blob/ee0c9e59f09b68de2a4e04ea7ba1b185df312ff9/src/loaders/custom.ts#L123

      facesMap[basename].files.push({
        src: file,
        path: join('/', relative(root, file.replace(options.stripPrefix, ''))), <---------
        format,
        ext,
      })

if I remove join and leave it as just path: relative(root, file.replace(options.stripPrefix, '')) then it works (at least for Vite). The URL is correctly generated with /@fs/ prefix if it's outside of the projects path.

Is it the correct solution? @stafyniaksacha