Skip to content

Commit dd77323

Browse files
jcary741Jay Caryvincentsarago
authored
Improve XSS security (#953)
* improve XSS security * update changelog --------- Co-authored-by: Jay Cary <[email protected]> Co-authored-by: vincentsarago <[email protected]>
1 parent 536b6a4 commit dd77323

File tree

6 files changed

+54
-23
lines changed

6 files changed

+54
-23
lines changed

‎CHANGES.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
## Unreleased
44

5+
* Improve XSS security for HTML templates (author @jcary741, https://github.com/developmentseed/titiler/pull/953)
6+
57
* Encode URL for cog_viewer and stac_viewer (author @guillemc23, https://github.com/developmentseed/titiler/pull/961)
68

79
* Remove all default values to the dependencies

‎docs/src/benchmark.html‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,8 +103,9 @@
103103
<div class="spacer"></div>
104104
<div class="small">Powered by <a rel="noopener" href="https://github.com/marketplace/actions/continuous-benchmark">github-action-benchmark</a></div>
105105
</footer>
106-
107-
<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/Chart.min.js"></script>
106+
<script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.9.2/Chart.min.js"
107+
integrity="sha512-uWTfEVcTAr+NF8RnQix39Vnfd93celVTAjU2pi4LpdrsPLeLg5RYywi5rw9oF8oCQaJ6b2YPALceNbf3kfDJaA=="
108+
crossorigin="anonymous" referrerpolicy="no-referrer"></script>
108109
<script id="main-script">
109110
'use strict';
110111
(function() {

‎src/titiler/application/titiler/application/templates/index.html‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@
44
<title>{{ template.title }}</title>
55
<meta charset="utf-8" />
66
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
7-
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.3/css/bootstrap.min.css" />
7+
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.5.3/css/bootstrap.min.css"
8+
integrity="sha512-oc9+XSs1H243/FRN9Rw62Fn8EtxjEYWHXRvjS43YtueEewbS6ObfXcJNyohjHqVKFPoXXUxwc+q1K7Dee6vv9g=="
9+
crossorigin="anonymous" referrerpolicy="no-referrer"/>
810
<style>
911
html { position: relative; min-height: 100%; }
1012
body { padding-top: 5rem; margin-bottom: 40px; }
@@ -19,8 +21,12 @@
1921
display: inline;
2022
}
2123
</style>
22-
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
23-
<script src="https://files.dnr.state.mn.us/lib/bootstrap4/javascripts/bootstrap.min.js"></script>
24+
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js"
25+
integrity="sha512-894YE6QWD5I59HgZOGReFYm4dnWc1Qt5NtvYSaNcOP+u1T9qYdvdihz0PPSiiqn/+/3e7Jo4EaG7TubfWGUrMQ=="
26+
crossorigin="anonymous" referrerpolicy="no-referrer"></script>
27+
<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.5.3/js/bootstrap.min.js"
28+
integrity="sha512-8qmis31OQi6hIRgvkht0s6mCOittjMa9GMqtK9hes5iEQBQE/Ca6yGE5FsW36vyipGoWQswBj/QBm2JR086Rkw=="
29+
crossorigin="anonymous" referrerpolicy="no-referrer"></script>
2430
</head>
2531
<body>
2632
<nav class="navbar navbar-expand-md navbar-light fixed-top bg-light">

‎src/titiler/core/titiler/core/templates/map.html‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,18 @@
44
<meta charset='utf-8' />
55
<title>TiTiler Map Viewer</title>
66
<meta name='viewport' content='initial-scale=1,maximum-scale=1,user-scalable=no' />
7-
<link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/leaflet.css"/>
8-
<script src="https://unpkg.com/[email protected]/dist/leaflet.js"></script>
9-
<script src="https://unpkg.com/[email protected]/dist/proj4.js"></script>
10-
<script src="https://unpkg.com/[email protected]/src/proj4leaflet.js"></script>
7+
<link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/leaflet.css"
8+
integrity="sha384-o/2yZuJZWGJ4s/adjxVW71R+EO/LyCwdQfP5UWSgX/w87iiTXuvDZaejd3TsN7mf"
9+
crossorigin="anonymous"/>
10+
<script src="https://unpkg.com/[email protected]/dist/leaflet.js"
11+
integrity="sha384-okbbMvvx/qfQkmiQKfd5VifbKZ/W8p1qIsWvE1ROPUfHWsDcC8/BnHohF7vPg2T6"
12+
crossorigin="anonymous"></script>
13+
<script src="https://unpkg.com/[email protected]/dist/proj4.js"
14+
integrity="sha384-R7x++v2MKcATI+D1/GJsn636xbHca492Sdpm8BD36lj5vdWB9+OUBpM1oKkrzqv9"
15+
crossorigin="anonymous"></script>
16+
<script src="https://unpkg.com/[email protected]/src/proj4leaflet.js"
17+
integrity="sha384-aDnBHDK9AhLbrYhThBxEVMriFbix8Sz2059IlD3HbZhz7+WNmz+pSkOcI7MY72cE"
18+
crossorigin="anonymous"></script>
1119
<style>
1220
body { margin:0; padding:0; width:100%; height:100%; background-color: #e5e5e5;}
1321
#map { position:absolute; top:0; bottom:0; width:100%; }

‎src/titiler/extensions/titiler/extensions/templates/cog_viewer.html‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,20 @@
44
<meta charset='utf-8' />
55
<title>TiTiler - Cloud Optimized GeoTIFF Viewer</title>
66
<meta name='viewport' content='initial-scale=1,maximum-scale=1,user-scalable=no' />
7-
8-
<script src='https://unpkg.com/[email protected]/dist/maplibre-gl.js'></script>
9-
<link href='https://unpkg.com/[email protected]/dist/maplibre-gl.css' rel='stylesheet' />
10-
11-
<link href='https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.min.css' rel='stylesheet'>
12-
<script src='https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.js'></script>
13-
<script src="https://d3js.org/d3.v4.js"></script>
7+
<script src="https://unpkg.com/[email protected]/dist/maplibre-gl.js"
8+
integrity="sha384-d7ZDjW8dICoRWC3wnExUiOx1CgEcPFEPJmTdIo93yyxQLAUbUwa6yKg3tlACCOMf"
9+
crossorigin="anonymous"></script>
10+
<link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/maplibre-gl.css"
11+
integrity="sha384-g0Ap4cGP18FAKniFM6i06oyjTpBYleD9hZcGyVnlsc1JFbfedDo1Oqb9qxrxVB3a" crossorigin="anonymous"/>
12+
13+
<link rel="stylesheet" href="https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.min.css"
14+
integrity="sha384-J8dqIWgJSfbM291RNLiN7cjnxOqlHjAWfkLu/3HiuC1pJLq9ZCYiigcknWfCYi+h" crossorigin="anonymous"/>
15+
<script src="https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.js"
16+
integrity="sha384-cARSC/qj9L62maU7YhlT+Ca2yHyUEEnWvMVCilUdW02txMg0Iynxz3gMsvVpV9RG"
17+
crossorigin="anonymous"></script>
18+
<script src="https://d3js.org/d3.v4.js"
19+
integrity="sha384-2D+rRoPOU+IYMo2i8sD/TSf9L+6H+Dt8lxmKl1r7xyEcV83QdtJyeaoE1DHIG3F7"
20+
crossorigin="anonymous"></script>
1421
<style>
1522
body { margin:0; padding:0; width:100%; height:100%;}
1623
#map { position:absolute; top:0; bottom:0; width:100%; }

‎src/titiler/extensions/titiler/extensions/templates/stac_viewer.html‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,20 @@
44
<meta charset='utf-8' />
55
<title>TiTiler - STAC Viewer</title>
66
<meta name='viewport' content='initial-scale=1,maximum-scale=1,user-scalable=no' />
7-
8-
<script src='https://unpkg.com/[email protected]/dist/maplibre-gl.js'></script>
9-
<link href='https://unpkg.com/[email protected]/dist/maplibre-gl.css' rel='stylesheet' />
10-
11-
<link href='https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.min.css' rel='stylesheet'>
12-
<script src='https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.js'></script>
13-
<script src="https://d3js.org/d3.v4.js"></script>
7+
<script src="https://unpkg.com/[email protected]/dist/maplibre-gl.js"
8+
integrity="sha384-d7ZDjW8dICoRWC3wnExUiOx1CgEcPFEPJmTdIo93yyxQLAUbUwa6yKg3tlACCOMf"
9+
crossorigin="anonymous"></script>
10+
<link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/maplibre-gl.css"
11+
integrity="sha384-g0Ap4cGP18FAKniFM6i06oyjTpBYleD9hZcGyVnlsc1JFbfedDo1Oqb9qxrxVB3a" crossorigin="anonymous"/>
12+
13+
<link rel="stylesheet" href="https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.min.css"
14+
integrity="sha384-J8dqIWgJSfbM291RNLiN7cjnxOqlHjAWfkLu/3HiuC1pJLq9ZCYiigcknWfCYi+h" crossorigin="anonymous"/>
15+
<script src="https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.js"
16+
integrity="sha384-cARSC/qj9L62maU7YhlT+Ca2yHyUEEnWvMVCilUdW02txMg0Iynxz3gMsvVpV9RG"
17+
crossorigin="anonymous"></script>
18+
<script src="https://d3js.org/d3.v4.js"
19+
integrity="sha384-2D+rRoPOU+IYMo2i8sD/TSf9L+6H+Dt8lxmKl1r7xyEcV83QdtJyeaoE1DHIG3F7"
20+
crossorigin="anonymous"></script>
1421
<style>
1522
body { margin:0; padding:0; width:100%; height:100%;}
1623
#map { position:absolute; top:0; bottom:0; width:100%; }

0 commit comments

Comments
 (0)