maplibre-preview 1.9.0 → 1.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c43caaa2de2305aa8211b7d1de99aaf7337b6162d7d99a448f73007c717591a
-  data.tar.gz: b16f170dc316e26844ffa6dd44d8401d38ba9128a9cf0dc13bd3abd1b30d0507
+  metadata.gz: 4804849d0779e4a60b497a251fa9ad350615671a328d446b383c991b6fda041a
+  data.tar.gz: 3349b9e73f70f57d3dd83d3c3586c44a5180ec9cc5d93d5932e4b246f82a1003
 SHA512:
-  metadata.gz: 2401ce59b8a156a2b34ddeecc36a3c6ad4ae161f41fcf998d3e2a6c788cf096f62fde591327948bdf18f1625b8eb9d0e55f226f8d758f7d6b0d8524087bc43f1
-  data.tar.gz: ad6e8ab6f576675903edda6b0859df42ef467dffff70e651eaacb36bbb8c906806b7d3bfec2d29545bcad663bcc99a114d88b912edd22caf115d5b7ecbdada0f
+  metadata.gz: c8e02627ba370010afa83daf7e0d2770d6d0ea3dc919761b976789cbcc9f60f88735196c1546c50467e2eca8b468fe0212160b6dd20b88c0982b5787a4313a92
+  data.tar.gz: 823cfad1bf6bb3d5f2602d4a592654189b40fb7d594430409bf3d8610827e04069867901a5044abf9408049b29698b2bcd7fa72ff6f36e3e8be8db83e48a6a19

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [1.9.1] - 2026-05-15
+
+### Security
+- **Feature popup tooltips** - render style and feature tooltip values as DOM text instead of raw HTML to prevent script execution from untrusted style or tile data
+
 ## [1.9.0] - 2026-05-14
 
 ### Added

data/lib/maplibre-preview/version.rb

@@ -1,3 +1,3 @@
 module MapLibrePreview
-  VERSION = '1.9.0'
+  VERSION = '1.9.1'
 end

data/lib/maplibre-preview/views/maplibre_map.slim

@@ -774,20 +774,39 @@ javascript:
         return modifiedStyle;
     };
 
-    const popupFeature = (features, e, popup) => {
-        const tt = (tooltip, feat) => tooltip?.replace(/\{([^}]+)\}/g, (match, prop) => {
-            let value = feat;
-            for (const p of prop.split('.')) {
-                value = value?.[p];
-            }
-            return typeof value === 'object' ? JSON.stringify(value, null, 2) : (value || '');
+    const tooltipValue = (feat, prop) => {
+        let value = feat;
+        for (const p of prop.split('.')) {
+            value = value?.[p];
+        }
+        return typeof value === 'object' ? JSON.stringify(value, null, 2) : (value || '');
+    };
+
+    const tooltipText = (tooltip, feat) => tooltip?.replace(/\{([^}]+)\}/g, (match, prop) => tooltipValue(feat, prop));
+
+    const defaultTooltipText = (feat) => [
+        `"id": ${tooltipValue(feat, 'id')}`,
+        `"source": ${tooltipValue(feat, 'source')}`,
+        `"source-layer": ${tooltipValue(feat, 'sourceLayer')}`,
+        `"properties": ${tooltipValue(feat, 'properties')}`
+    ].join('\n');
+
+    const createPopupContent = (tooltips) => {
+        const fragment = document.createDocumentFragment();
+        tooltips.forEach((tooltip, index) => {
+            if (index > 0) fragment.appendChild(document.createElement('br'));
+            const item = document.createElement('pre');
+            item.textContent = tooltip;
+            fragment.appendChild(item);
         });
+        return fragment;
+    };
 
+    const popupFeature = (features, e, popup) => {
         const tooltips = features.map((feat) =>
-            tt(feat.layer.metadata?.tooltip, feat) ||
-            tt(`<pre>"id": {id},\n"source": {source},\n"source-layer": {sourceLayer},\n"properties": {properties}</pre>`, feat)
+            tooltipText(feat.layer.metadata?.tooltip, feat) || defaultTooltipText(feat)
         );
-        popup.setLngLat(e.lngLat).setHTML(tooltips.join('<br>')).addTo(map);
+        popup.setLngLat(e.lngLat).setDOMContent(createPopupContent(tooltips)).addTo(map);
     };
 
     const initializeMap = async () => {

data/spec/maplibre_preview_spec.rb

@@ -81,6 +81,16 @@ RSpec.describe MapLibrePreview do
       expect(last_response.body).to include('window.toggleStyleParametersPanel')
     end
 
+    it 'renders feature popup tooltips as DOM text instead of raw HTML' do
+      get '/?style_url=https://example.com/style.json'
+      expect(last_response).to be_ok
+
+      expect(last_response.body).to include('createPopupContent')
+      expect(last_response.body).to include('item.textContent = tooltip')
+      expect(last_response.body).to include('setDOMContent(createPopupContent(tooltips))')
+      expect(last_response.body).not_to include('setHTML(tooltips')
+    end
+
     it 'serves all required JavaScript modules' do
       %w[/js/overlay_layout.js /js/filters.js /js/contour.js /js/tilegrid.js /js/temporal_picker.js /vendor/maplibre-gl/maplibre-gl.js /vendor/maplibre-contour/index.min.js /vendor/d3/d3.v7.min.js].each do |js_file|
         get js_file

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: maplibre-preview
 version: !ruby/object:Gem::Version
-  version: 1.9.0
+  version: 1.9.1
 platform: ruby
 authors:
 - Alexander Ludov
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-14 00:00:00.000000000 Z
+date: 2026-05-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack