maplibre-preview 1.9.0 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c43caaa2de2305aa8211b7d1de99aaf7337b6162d7d99a448f73007c717591a
-  data.tar.gz: b16f170dc316e26844ffa6dd44d8401d38ba9128a9cf0dc13bd3abd1b30d0507
+  metadata.gz: d77238823bad1c9b83f993dab458e964ffd16fb6015f3506bbd62d86b690e131
+  data.tar.gz: 70b749547c4d2115fc20a0bde6c43ceb3303ddf1b22a1fc4a570e1ae12117552
 SHA512:
-  metadata.gz: 2401ce59b8a156a2b34ddeecc36a3c6ad4ae161f41fcf998d3e2a6c788cf096f62fde591327948bdf18f1625b8eb9d0e55f226f8d758f7d6b0d8524087bc43f1
-  data.tar.gz: ad6e8ab6f576675903edda6b0859df42ef467dffff70e651eaacb36bbb8c906806b7d3bfec2d29545bcad663bcc99a114d88b912edd22caf115d5b7ecbdada0f
+  metadata.gz: 0e64e1a5d7e2334ad705a18ccca590143d33c1c562094a0fb216aa2502b4b2666736633404e08d1233f5d260d978c7e8006a4f96e02122303199a066f2a8b20e
+  data.tar.gz: 51dbf7525797540e8de7ba77400d4d062bfb8cf2a6bbb1248b7c8e8b5027341825afe2654bc76bac64f5af6f6cc9e36b0d43b339534f6f7749b779a36c9867bd

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [1.10.0] - 2026-05-20
+
+### Added
+- **Host coordinate selection** - emit `maplibre-preview:coordinate-selected` with `lat` and `lon` on map clicks for embedded host applications
+
+### Changed
+- **Embedded preview route** - pass configured preview options into the `/maplibre_preview` template route
+
+## [1.9.1] - 2026-05-15
+
+### Security
+- **Feature popup tooltips** - render style and feature tooltip values as DOM text instead of raw HTML to prevent script execution from untrusted style or tile data
+
 ## [1.9.0] - 2026-05-14
 
 ### Added

data/lib/maplibre-preview/version.rb

@@ -1,3 +1,3 @@
 module MapLibrePreview
-  VERSION = '1.9.0'
+  VERSION = '1.10.0'
 end

data/lib/maplibre-preview/views/maplibre_map.slim

@@ -774,20 +774,50 @@ javascript:
         return modifiedStyle;
     };
 
-    const popupFeature = (features, e, popup) => {
-        const tt = (tooltip, feat) => tooltip?.replace(/\{([^}]+)\}/g, (match, prop) => {
-            let value = feat;
-            for (const p of prop.split('.')) {
-                value = value?.[p];
-            }
-            return typeof value === 'object' ? JSON.stringify(value, null, 2) : (value || '');
+    const tooltipValue = (feat, prop) => {
+        let value = feat;
+        for (const p of prop.split('.')) {
+            value = value?.[p];
+        }
+        return typeof value === 'object' ? JSON.stringify(value, null, 2) : (value || '');
+    };
+
+    const tooltipText = (tooltip, feat) => tooltip?.replace(/\{([^}]+)\}/g, (match, prop) => tooltipValue(feat, prop));
+
+    const defaultTooltipText = (feat) => [
+        `"id": ${tooltipValue(feat, 'id')}`,
+        `"source": ${tooltipValue(feat, 'source')}`,
+        `"source-layer": ${tooltipValue(feat, 'sourceLayer')}`,
+        `"properties": ${tooltipValue(feat, 'properties')}`
+    ].join('\n');
+
+    const createPopupContent = (tooltips) => {
+        const fragment = document.createDocumentFragment();
+        tooltips.forEach((tooltip, index) => {
+            if (index > 0) fragment.appendChild(document.createElement('br'));
+            const item = document.createElement('pre');
+            item.textContent = tooltip;
+            fragment.appendChild(item);
         });
+        return fragment;
+    };
 
+    const popupFeature = (features, e, popup) => {
         const tooltips = features.map((feat) =>
-            tt(feat.layer.metadata?.tooltip, feat) ||
-            tt(`<pre>"id": {id},\n"source": {source},\n"source-layer": {sourceLayer},\n"properties": {properties}</pre>`, feat)
+            tooltipText(feat.layer.metadata?.tooltip, feat) || defaultTooltipText(feat)
         );
-        popup.setLngLat(e.lngLat).setHTML(tooltips.join('<br>')).addTo(map);
+        popup.setLngLat(e.lngLat).setDOMContent(createPopupContent(tooltips)).addTo(map);
+    };
+
+    const emitCoordinateSelection = (lngLat) => {
+        const payload = {
+            type: 'maplibre-preview:coordinate-selected',
+            lat: lngLat.lat,
+            lon: lngLat.lng
+        };
+
+        window.dispatchEvent(new CustomEvent(payload.type, {detail: payload}));
+        window.parent !== window && window.parent.postMessage(payload, window.location.origin);
     };
 
     const initializeMap = async () => {
@@ -899,6 +929,8 @@ javascript:
         const popup = new maplibregl.Popup({closeButton: false, closeOnClick: false});
 
         map.on('click', function (e) {
+            emitCoordinateSelection(e.lngLat);
+
             if (profileMode) {
                 handleProfileClick(e);
                 return;

data/lib/maplibre-preview.rb

@@ -33,7 +33,7 @@ module MapLibrePreview
       app.set :maplibre_preview_options, {}
 
       app.get '/maplibre_preview' do
-        slim :maplibre_map, layout: :maplibre_layout
+        slim :maplibre_map, layout: :maplibre_layout, locals: { options: settings.maplibre_preview_options }
       end
     end
   end

data/spec/maplibre_preview_spec.rb

@@ -15,6 +15,7 @@ RSpec.describe MapLibrePreview do
       expect(last_response.body).to include('maplibre-contour')
       expect(last_response.body).to include('d3')
       expect(last_response.body).to include('overlay_layout')
+      expect(last_response.body).to include('maplibre-preview:coordinate-selected')
     end
 
     it 'renders map cache toggle wiring' do
@@ -81,6 +82,24 @@ RSpec.describe MapLibrePreview do
       expect(last_response.body).to include('window.toggleStyleParametersPanel')
     end
 
+    it 'renders feature popup tooltips as DOM text instead of raw HTML' do
+      get '/?style_url=https://example.com/style.json'
+      expect(last_response).to be_ok
+
+      expect(last_response.body).to include('createPopupContent')
+      expect(last_response.body).to include('item.textContent = tooltip')
+      expect(last_response.body).to include('setDOMContent(createPopupContent(tooltips))')
+      expect(last_response.body).not_to include('setHTML(tooltips')
+    end
+
+    it 'emits selected coordinates for host applications' do
+      get '/'
+      expect(last_response).to be_ok
+
+      expect(last_response.body).to include('emitCoordinateSelection(e.lngLat)')
+      expect(last_response.body).to include('window.parent.postMessage(payload, window.location.origin)')
+    end
+
     it 'serves all required JavaScript modules' do
       %w[/js/overlay_layout.js /js/filters.js /js/contour.js /js/tilegrid.js /js/temporal_picker.js /vendor/maplibre-gl/maplibre-gl.js /vendor/maplibre-contour/index.min.js /vendor/d3/d3.v7.min.js].each do |js_file|
         get js_file

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: maplibre-preview
 version: !ruby/object:Gem::Version
-  version: 1.9.0
+  version: 1.10.0
 platform: ruby
 authors:
 - Alexander Ludov
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-14 00:00:00.000000000 Z
+date: 2026-05-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack