@datagouv/components-next 1.0.2-dev.202 → 1.0.2-dev.203

package/dist/{vue3-xml-viewer.common-UMibNgKb.js → vue3-xml-viewer.common-BzKiHzXQ.js}

@@ -1,4 +1,4 @@
-import { g as Ke } from "./main--ZN-jusz.js";
+import { g as Ke } from "./main-CICNrWF8.js";
 import We from "vue";
 function Fe(I, K) {
   for (var V = 0; V < K.length; V++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datagouv/components-next",
-  "version": "1.0.2-dev.202",
+  "version": "1.0.2-dev.203",
   "private": false,
   "type": "module",
   "engines": {

package/src/components/ResourceAccordion/Pmtiles.client.vue

@@ -67,7 +67,7 @@ import styleVector from '../../../assets/json/vector.json'
 import PreviewUnavailable from './PreviewUnavailable.vue'
 import { useTranslation } from '../../composables/useTranslation'
 import franceSvg from './france.svg?raw'
-import { getOwnerName, getOwnerPage } from '../../functions/owned'
+import { getMapAttribution } from '../../functions/owned'
 
 const props = defineProps<{ resource: Resource, dataset: Dataset | DatasetV2 }>()
 
@@ -94,11 +94,7 @@ const lastUpdate = computed(() => {
 
 const container = useTemplateRef('containerRef')
 
-const attributions = computed(() => {
-  if (!props.dataset.organization && !props.dataset.owner)
-    return ''
-  return `© <a href="${getOwnerPage(props.dataset)}" target="_blank">${getOwnerName(props.dataset)}</a>`
-})
+const attributions = computed(() => getMapAttribution(props.dataset))
 
 async function displayMap() {
   await import('maplibre-gl/dist/maplibre-gl.css')

package/src/functions/owned.ts

@@ -19,3 +19,24 @@ export function getOwnerPage(owned: Owned): string | null {
   }
   return null // Not supposed to exist but it does...
 }
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
+export function getMapAttribution(owned: Owned): string {
+  const name = getOwnerName(owned)
+  const page = getOwnerPage(owned)
+  if (!name && !page)
+    return ''
+  // The owner name is free text any user controls (organization name, or a
+  // profile's first/last name). maplibre-gl injects this attribution string
+  // into the DOM as HTML, and its own attribution sanitizer is bypassable via
+  // mutation XSS, so every interpolated value has to be escaped here.
+  return `© <a href="${escapeHtml(page ?? '')}" target="_blank">${escapeHtml(name)}</a>`
+}