Installing custom fonts genereates untracked 'fonts' directory

[afercia]

When developing on trunk and installing custom fonts (e.g. Google fonts) in the editor, a new /src/wp-content/fonts/ directory is generated.

The git status comannd will report:

Untracked files:
  (use "git add <file>..." to include in what will be committed)
	src/wp-content/fonts/

Similarly for SVN.

This directory should either svn ignored and git ignored or committed to core.

[ironprogrammer]

Thanks for the report, @afercia!

This .gitignore update is being tracked in #59166 (specifically) as part of the Font Library feature.

It's not exactly a dupe, so I'm unsure how best to track or close this going forward. CC @mikachan @hellofromTonya.

[afercia]

Thanks @ironprogrammer

Together with @poena and @SergeyBiryukov we were thinking the generated fonts directory would likely be reported by security plugins as a security issue. One one hand this could be addressed with a deev note informing plugin authors to update their rules. On the other hand, wouldn't be simpler to just commit the fonts directory so that it's part of a default installation even if empty?

[swissspidy]

See ​https://github.com/WordPress/wordpress-develop/pull/5190 for a patch

Svn ignore needs to he updated top

[swissspidy]

On the other hand, wouldn't be simpler to just commit the fonts directory so that it's part of a default installation even if empty?

wp-content/uploads or wp-content/upgrade are not part of the default installation either and only created when needed.

[swissspidy]

In 57640:

Build/Test Tools: Ignore src/wp-content/fonts from version control.

Props ironprogrammer, afercia.
Fixes #60337.

[afercia]

wp-content/uploads or wp-content/upgrade are not part of the default installation either and only created when needed.

Right, thanks @swissspidy. Then I'd say a dev-note is worth it to inform plugin authors a new fonts directory may be generated at some point.

[swissspidy]

This can be added to the general fonts library dev-note for sure. cc @mmaattiiaass