defra_ruby_map 0.2.2 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a2f98d96f22c559bf065e71a385e2e6c44e15a3f88849472894991d97bc8d84
-  data.tar.gz: 2c06e945bfc6341124f8a3d1de8660059a2e152bba0272322edea1af245e23ad
+  metadata.gz: e8d9078473375bc26c9e8ed1dc672681d0cc2480beebe95d7b57416062bf8864
+  data.tar.gz: fe3aa53459ade42a9a4140fa3e0263431e24c6b91065fa8ec108315abb7204e5
 SHA512:
-  metadata.gz: fc3cac76f70d43922c65dac966120e095b198040cd5902f6c60a2329c2efc74a49aba372ccf2f0e1dc6e90eb869771585d6542e57e8b8fbec88ac112a2768997
-  data.tar.gz: 2e4089710844a5774c5b9c9ffc892c0cdfb347bf791bd4aa3418985f283623a6dae61cd883671b38a942691e1d8e1f3b8b58ea939b29c1dc1b6bfc4ab1845254
+  metadata.gz: 57b7d95465988b03bd267528fa0750649c63757fe03ed872517f0e2d09137d353a516c20ac9347d7d099c14c7877907c5e5490d57a15ab8a516e07115378e188
+  data.tar.gz: b5640a889bde939f5fd0fc45b72abf6ff7ebbbf123a4c22e0561b35252a167d2201656bb462161265f0d0d2a9d231a4a622e6e08c86d9700b705b67992696357

data/app/assets/javascripts/defra-ruby-map/map_init.js

@@ -30,30 +30,23 @@
     backgroundColor: "#f5f5f0"
   };
 
-  const HTML_ENTITIES = { "&": "&amp;", "<": "&lt;", ">": "&gt;", "\"": "&quot;", "'": "&#39;" };
-  function escapeHtml(str) {
-    return String(str).replace(/[&<>"']/g, function (c) { return HTML_ENTITIES[c]; });
-  }
-
-  // Maps OS Places API results to the search plugin's suggestion shape. The
-  // plugin renders `marked` via dangerouslySetInnerHTML, so the address text
-  // is HTML-escaped before the matched query is wrapped in <mark> — otherwise
-  // HTML in an OS address would execute (stored XSS).
+  // Maps OS Places API results to the search plugin's suggestion shape. Since
+  // v0.0.56 the plugin renders `marked` as text (only bare <mark> tags become
+  // elements), so the address must not be HTML-escaped or entities would show.
   function parseOsPlacesResults(data, query) {
     if (!data?.results) { return []; }
-    const safeQuery = escapeHtml(query || "").replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-    const matcher = safeQuery ? new RegExp(`(${safeQuery})`, "gi") : null;
+    const queryPattern = (query || "").replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+    const matcher = queryPattern ? new RegExp(`(${queryPattern})`, "gi") : null;
     return data.results.map(function (item) {
       const record = item.DPA || item.LPI;
       if (!record) { return null; }
       const text = record.ADDRESS || "";
-      const safeText = escapeHtml(text);
       const lng = record.LNG || 0;
       const lat = record.LAT || 0;
       return {
         id: String(record.UPRN),
         text: text,
-        marked: matcher ? safeText.replace(matcher, "<mark>$1</mark>") : safeText,
+        marked: matcher ? text.replace(matcher, "<mark>$1</mark>") : text,
         point: [lng, lat],
         bounds: [
           lng - SUGGESTION_BOUNDS_PADDING,
@@ -270,6 +263,6 @@
 
   window.DefraMap = {
     init: initMap,
-    _internal: { escapeHtml: escapeHtml, parseOsPlacesResults: parseOsPlacesResults }
+    _internal: { parseOsPlacesResults: parseOsPlacesResults }
   };
 })();

data/app/controllers/defra_ruby_map/proxy_controller.rb

@@ -77,16 +77,27 @@ module DefraRubyMap
         headers["ETag"] = response["ETag"] if response["ETag"]
         headers["Expires"] = response["Expires"] if response["Expires"]
       end
-      render body: response.body, status: status_code,
+      render body: scrub_api_key(response.body), status: status_code,
              content_type: response["Content-Type"] || "application/octet-stream"
     end
 
+    # OS echoes the key back in relayed bodies (e.g. the VTS "tiles" URLs and the style's
+    # sprite/glyphs/source URLs). Drop the key param so the browser never sees it
+    def scrub_api_key(body)
+      return body if body.blank? || body.exclude?(os_maps_api_key)
+
+      escaped_key = Regexp.escape(os_maps_api_key)
+      body.gsub(/(\?|&|\\u0026)key=#{escaped_key}((?:&|\\u0026)?)/) do
+        Regexp.last_match(2).empty? ? "" : Regexp.last_match(1)
+      end.gsub(os_maps_api_key, "")
+    end
+
     def proxy_get(base_url, params)
       uri = URI(base_url)
       uri.query = URI.encode_www_form(params)
 
       response = fetch_upstream(uri)
-      render(json: response.body, status: response.code.to_i)
+      render(json: scrub_api_key(response.body), status: response.code.to_i)
     rescue StandardError => e
       Rails.logger.error("[DefraRubyMap] #{action_name} upstream error: #{e.class}: #{e.message}")
       render(json: { error: "upstream service unavailable" }, status: :bad_gateway)

data/lib/defra_ruby_map/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DefraRubyMap
-  VERSION = "0.2.2"
+  VERSION = "0.2.3"
 end