fix: unwrap the geo div and throw error when input

location search not found

also fix the CSP rule that the img with data src might be violated

Signed-off-by: Yukai Huang <[email protected]>
Co-authored-by: Max Wu <[email protected]>

Author: Yukaii

lib/csp.js

@@ -7,7 +7,7 @@ var defaultDirectives = {
   defaultSrc: ['\'self\''],
   scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', 'https://query.yahooapis.com', '\'unsafe-eval\''],
   // ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/codimd/issues/594
-  imgSrc: ['*'],
+  imgSrc: ['*', 'data:'],
   styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://github.githubassets.com'], // unsafe-inline is required for some libs, plus used in views
   fontSrc: ['\'self\'', 'data:', 'https://public.slidesharecdn.com'],
   objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/

public/js/extra.js

@@ -453,10 +453,13 @@ export function finishView (view) {
       console.warn(err)
     }
   })
+  // geo map
   view.find('div.geo.raw').removeClass('raw').each(async function (key, value) {
     const $elem = $(value).parent().parent()
     const $value = $(value)
     const content = $value.text()
+    $value.unwrap()
+
     try {
       let position, zoom
       if (content.match(/^[\d.,\s]+$/)) {
@@ -466,6 +469,9 @@ export function finishView (view) {
       } else {
         // parse value as address
         const data = await fetch(`https://nominatim.openstreetmap.org/search?q=${encodeURIComponent(content)}&format=json`).then(r => r.json())
+        if (!data || !data.length) {
+          throw new Error('Location not found')
+        }
         const { lat, lon } = data[0]
         position = [lat, lon]
       }