@itwin/core-frontend 5.13.0-dev.9 → 5.14.0-dev.1

package/lib/cjs/tile/map/MapLayerImageryProvider.d.ts

@@ -7,12 +7,35 @@ import { ScreenViewport } from "../../Viewport";
 import { ImageryMapTile, ImageryMapTileTree, MapCartoRectangle, MapFeatureInfoOptions, MapLayerFeatureInfo, MapTilingScheme, QuadId } from "../internal";
 import { HitDetail } from "../../HitDetail";
 import { DecorateContext } from "../../ViewContext";
+/** Escapes HTML metacharacters so the text renders literally when assigned to `innerHTML`.
+ * Use for any server- or user-supplied string that ends up in the map tooltip, which is rendered
+ * as HTML by [[MapLayerTileTreeReference.getToolTip]].
+ * @internal
+ */
+export declare function escapeHtml(text: string): string;
+/** Returns the origin (scheme + host + port) of the given URL, or undefined if it cannot be parsed or does
+ * not denote a distinct network origin.
+ *
+ * Only `http:` and `https:` URLs yield an origin. Every other scheme is rejected because opaque URLs
+ * — `file:`, `data:`, `about:`, `blob:null`, and the custom protocols Electron hosts commonly register —
+ * all serialize to the literal string `"null"`. Comparing those would make unrelated URLs look same-origin,
+ * so a single trusted entry could unlock all of them. Callers use this for credential-trust decisions, and
+ * returning `undefined` keeps those decisions fail-closed.
+ * @internal
+ */
+export declare function tryGetOrigin(url: string): string | undefined;
 /** The status of the map layer imagery provider that lets you know if authentication is needed to request tiles.
  * @public
  */
 export declare enum MapLayerImageryProviderStatus {
     Valid = 0,
-    RequireAuth = 1
+    RequireAuth = 1,
+    /** A request received an authentication challenge, but credentials were withheld because the request origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * The blocked origins are available via [[MapLayerImageryProvider.blockedOrigins]].
+     * @beta
+     */
+    UntrustedOrigin = 2
 }
 /** @internal */
 export interface WGS84Extent {
@@ -37,7 +60,34 @@ export declare abstract class MapLayerImageryProvider {
     /** @internal */
     private _status;
     /** @internal */
-    protected _includeUserCredentials: boolean;
+    private readonly _blockedOrigins;
+    /** Origins of requests for which credentials were withheld because they are not trusted
+     * (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Populated when [[status]] transitions to [[MapLayerImageryProviderStatus.UntrustedOrigin]];
+     * [[onStatusChanged]] is raised again each time a new origin is added. Cleared by [[resetStatus]].
+     * @beta
+     */
+    get blockedOrigins(): ReadonlyArray<string>;
+    /** Origins for which a previous SSO handshake (i.e. Windows Authentication) succeeded.
+     * Browser credentials are only included for subsequent requests targeting these origins,
+     * so that a successful handshake with one host does not leak credentials to other hosts
+     * this provider may contact.
+     * @internal
+     */
+    private readonly _ssoSucceededOrigins;
+    /** Returns true if browser credentials should be included for the given URL because a previous
+     * SSO handshake succeeded for its origin AND the origin is still allowed by the current policy
+     * (see [[MapLayerFormatRegistry.isSsoAllowed]]). Re-checking the policy ensures a handshake recorded
+     * while enforcement was disabled — or before an origin was removed from
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]] — does not keep latching credentials on.
+     * @internal
+     */
+    protected includeUserCredentials(url: string): boolean;
+    /** Records that an SSO handshake succeeded for the given URL's origin, so subsequent requests
+     * to that origin include browser credentials without going through another 401 challenge.
+     * @internal
+     */
+    protected recordSsoSucceeded(url: string): void;
     /** @internal */
     protected readonly onFirstRequestCompleted: BeEvent<() => void>;
     /** @internal */
@@ -53,6 +103,13 @@ export declare abstract class MapLayerImageryProvider {
      * @public
      */
     get supportsMapFeatureInfo(): boolean;
+    /** Reset the provider's status to [[MapLayerImageryProviderStatus.Valid]] and clear the list of
+     * [[blockedOrigins]] accumulated while in the [[MapLayerImageryProviderStatus.UntrustedOrigin]] state.
+     * Raises [[onStatusChanged]] if the status actually changes.
+     * Typically called after the user has provided credentials or the application has updated
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]], so that subsequent requests are re-attempted.
+     * @beta
+     */
     resetStatus(): void;
     /** @internal */
     get tileSize(): number;
@@ -152,8 +209,67 @@ export declare abstract class MapLayerImageryProvider {
     protected onStatusUpdated(_newStatus: MapLayerImageryProviderStatus): void;
     /** @internal */
     protected setRequestAuthorization(headers: Headers): void;
+    /** Returns true if the given URL has the same origin as this layer's settings URL.
+     * Used to avoid leaking credentials to third-party hosts.
+     * @internal
+     */
+    protected matchesSettingsUrlOrigin(url: string): boolean;
+    /** Returns true if the basic-auth credentials from the layer settings may be attached to a request to the given URL.
+     * Always true unless [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled (opt-in).
+     * When enabled, the origin of this layer's settings URL is implicitly trusted (the credentials belong to that
+     * server); other origins must be listed in [[MapLayerFormatRegistry.trustedCredentialsOrigins]].
+     * See [[MapLayerFormatRegistry.isCredentialsSharingAllowed]].
+     * @internal
+     */
+    protected isCredentialsSharingAllowed(url: string): boolean;
+    /** Returns true if a request to the given URL may be retried with browser credentials included
+     * (i.e. SSO / Windows Authentication) after an NTLM or Negotiate http 401 challenge.
+     * See [[MapLayerFormatRegistry.isSsoAllowed]].
+     * @internal
+     */
+    protected isSsoAllowed(url: string): boolean;
     /** @internal */
     makeTileRequest(url: string, timeoutMs?: number, authorization?: string): Promise<Response>;
+    /** Records the given URL's origin and transitions the status to [[MapLayerImageryProviderStatus.UntrustedOrigin]].
+     * Called when a request received an authentication challenge that could not be answered because the origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Raises [[onStatusChanged]] on the status transition, and again whenever a new origin is added.
+     * @internal
+     */
+    protected reportBlockedOrigin(url: string): void;
+    /** Logs a warning (once per origin, app-wide) when credentials are sent to an origin that would be blocked
+     * if [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] were enabled.
+     * Helps applications discover the origins they need to whitelist before opting in to the restriction.
+     * See [[MapLayerFormatRegistry.logUntrustedOriginUse]].
+     * @internal
+     */
+    protected logUntrustedOriginUse(url: string): void;
+    /** The redirect policy to apply to a request that carries browser credentials (see [[includeUserCredentials]]).
+     *
+     * When [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled, redirects are refused
+     * outright (`"error"`). `fetch` cannot be asked to follow only same-origin redirects, and by the time a
+     * followed redirect can be inspected the credentials have already been delivered to the destination — so
+     * refusing is the only way to honour the guarantee that credentials reach none but the origins listed in
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]]. Legitimate same-origin redirects fail as a result;
+     * that is the cost of the opt-in restriction.
+     *
+     * When the restriction is disabled (the default), redirects are followed as before and
+     * [[checkCredentialedRedirect]] reports the destination after the fact.
+     * @internal
+     */
+    protected get credentialedRedirect(): RequestRedirect | undefined;
+    /** Detects that a request carrying browser credentials (see [[includeUserCredentials]]) was transparently
+     * redirected to a different origin, and reports or logs that origin.
+     *
+     * This is a **best-effort, after-the-fact** signal used only while
+     * [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is disabled, where credentialed requests
+     * still follow redirects (see [[credentialedRedirect]]). It cannot prevent the exposure — the credentials
+     * have already been sent — and it does not fire at all when the destination denies CORS, because `fetch`
+     * then rejects instead of returning a `Response`. The destination origin is never latched as SSO-succeeded,
+     * so credentials do not keep flowing to it.
+     * @internal
+     */
+    protected checkCredentialedRedirect(requestedUrl: string, response: Response): void;
     /** @internal */
     makeRequest(url: string, timeoutMs?: number, authorization?: string): Promise<Response>;
     /** Returns a map layer tile at the specified settings. */

package/lib/cjs/tile/map/MapLayerImageryProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MapLayerImageryProvider.d.ts","sourceRoot":"","sources":["../../../../src/tile/map/MapLayerImageryProvider.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,OAAO,EAAU,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAqB,MAAM,oBAAoB,CAAC;AAIzG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAA6C,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,EAA2B,MAAM,aAAa,CAAC;AAC7N,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAOpD;;GAEG;AACH,oBAAY,6BAA6B;IACvC,KAAK,IAAA;IACL,WAAW,IAAA;CACZ;AAED,gBAAgB;AAChB,MAAM,WAAW,WAAW;IAE1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,8BAAsB,uBAAuB;IAoG/B,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,qBAAqB;IAAE,SAAS,CAAC,gBAAgB,EAAE,OAAO;IAnGpG,SAAS,CAAC,2BAA2B,UAAS;IAC9C,SAAgB,eAAe,qBAA0B,uBAAuB,KAAK,IAAI,EAAI;IAE7F,gBAAgB;IAChB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAiC;IAEvE,gBAAgB;IAChB,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;IAExE,gBAAgB;IAChB,OAAO,CAAC,OAAO,CAAuC;IAEtD,gBAAgB;IAChB,SAAS,CAAC,uBAAuB,UAAS;IAE1C,gBAAgB;IAChB,SAAS,CAAC,QAAQ,CAAC,uBAAuB,gBAAqB,IAAI,EAAI;IAEvE,gBAAgB;IAChB,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,GAAC,SAAS,CAAC;IAExD;;;OAGG;IACH,IAAW,MAAM,kCAA2B;IAE5C;;;;OAIG;IACH,IAAW,sBAAsB,IAAI,OAAO,CAAkB;IAEvD,WAAW;IAElB,gBAAgB;IAChB,IAAW,QAAQ,IAAI,MAAM,CAAqE;IAElG,gBAAgB;IAChB,IAAW,iBAAiB,WAAgC;IAE5D,IAAW,gBAAgB,IAAI,MAAM,CAAyC;IAE9E,IAAW,gBAAgB,IAAI,MAAM,CAAyC;IAE9E,gBAAgB;IAChB,IAAW,eAAe,YAAoC;IAE9D,IAAW,uBAAuB,IAAI,OAAO,CAAkB;IAE/D,gBAAgB;IAChB,IAAW,yBAAyB,YAAoB;IAExD,OAAO,CAAC,WAAW,CAAC,CAAoB;IAExC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B;;;OAGG;IACH,IAAW,UAAU,IAAI,iBAAiB,GAAG,SAAS,CAErD;IAED,IAAW,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,SAAS,EAEzD;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,uBAAuB,KAAK;IAE/C;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,uBAAuB,MAAM;IAEhD,gBAAgB;IAChB,SAAS,KAAK,mBAAmB,YAAmB;gBAErB,SAAS,EAAE,qBAAqB,EAAY,gBAAgB,EAAE,OAAO;IAKpG;;;OAGG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;aAOxB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE7F,IAAW,YAAY,IAAI,eAAe,CAAuG;IAEjJ,kGAAkG;IAC3F,YAAY,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,GAAG,IAAI;IAE9E;;;;;OAKG;IACU,eAAe,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxF,gBAAgB;IAChB,SAAS,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC;IAExC,gBAAgB;IAChB,IAAW,2BAA2B,IAAI,MAAM,CAAoE;IAEpH,gBAAgB;cACA,qBAAqB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAE9E,gBAAgB;IACT,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE;IAKrD;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI;IAIzF,gBAAgB;IACT,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI;IAQ3F;;;;;;;OAOG;IACU,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzH,gBAAgB;IACH,cAAc,CAAC,YAAY,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpM,gBAAgB;IACR,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAGjD,gBAAgB;cACA,wBAAwB,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;IA0BlF;;;;OAIG;IACI,SAAS,CAAC,MAAM,EAAE,6BAA6B;IAQtD;;OAEG;IACH,SAAS,CAAC,eAAe,CAAC,UAAU,EAAE,6BAA6B;IAEnE,gBAAgB;IAChB,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO;IAMlD,gBAAgB;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAsBxG,gBAAgB;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4CpG,0DAA0D;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IA+BvG,gBAAgB;cACA,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7E,gBAAgB;IACT,kBAAkB,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO;IAaxD;;;;OAIG;IACI,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI9C;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAK7C;;;;OAIG;IACI,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI5C;;;;OAIG;IACI,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAK5C;;;;;;;;OAQG;IACI,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW;IAkBrF;;;;;;OAMG;IACI,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAWtI,gBAAgB;IACT,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAK7E,gBAAgB;IACT,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO;IAM/G,gBAAgB;IACT,uBAAuB,CAAC,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO;IASpF;;OAEG;IACH,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM;CAQzC"}
+{"version":3,"file":"MapLayerImageryProvider.d.ts","sourceRoot":"","sources":["../../../../src/tile/map/MapLayerImageryProvider.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,OAAO,EAAU,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAqB,MAAM,oBAAoB,CAAC;AAIzG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAA6C,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,EAA2B,MAAM,aAAa,CAAC;AAC7N,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAOpD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS5D;AAED;;GAEG;AACH,oBAAY,6BAA6B;IACvC,KAAK,IAAA;IACL,WAAW,IAAA;IACX;;;;OAIG;IACH,eAAe,IAAA;CAChB;AAED,gBAAgB;AAChB,MAAM,WAAW,WAAW;IAE1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,8BAAsB,uBAAuB;IAoJ/B,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,qBAAqB;IAAE,SAAS,CAAC,gBAAgB,EAAE,OAAO;IAnJpG,SAAS,CAAC,2BAA2B,UAAS;IAC9C,SAAgB,eAAe,qBAA0B,uBAAuB,KAAK,IAAI,EAAI;IAE7F,gBAAgB;IAChB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAiC;IAEvE,gBAAgB;IAChB,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;IAExE,gBAAgB;IAChB,OAAO,CAAC,OAAO,CAAuC;IAEtD,gBAAgB;IAChB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD;;;;;OAKG;IACH,IAAW,cAAc,IAAI,aAAa,CAAC,MAAM,CAAC,CAAsC;IAExF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D;;;;;;OAMG;IACH,SAAS,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAKtD;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM/C,gBAAgB;IAChB,SAAS,CAAC,QAAQ,CAAC,uBAAuB,gBAAqB,IAAI,EAAI;IAEvE,gBAAgB;IAChB,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,GAAC,SAAS,CAAC;IAExD;;;OAGG;IACH,IAAW,MAAM,kCAA2B;IAE5C;;;;OAIG;IACH,IAAW,sBAAsB,IAAI,OAAO,CAAkB;IAE9D;;;;;;OAMG;IACI,WAAW;IAKlB,gBAAgB;IAChB,IAAW,QAAQ,IAAI,MAAM,CAAqE;IAElG,gBAAgB;IAChB,IAAW,iBAAiB,WAAgC;IAE5D,IAAW,gBAAgB,IAAI,MAAM,CAAyC;IAE9E,IAAW,gBAAgB,IAAI,MAAM,CAAyC;IAE9E,gBAAgB;IAChB,IAAW,eAAe,YAAoC;IAE9D,IAAW,uBAAuB,IAAI,OAAO,CAAkB;IAE/D,gBAAgB;IAChB,IAAW,yBAAyB,YAAoB;IAExD,OAAO,CAAC,WAAW,CAAC,CAAoB;IAExC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B;;;OAGG;IACH,IAAW,UAAU,IAAI,iBAAiB,GAAG,SAAS,CAErD;IAED,IAAW,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,SAAS,EAEzD;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,uBAAuB,KAAK;IAE/C;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,uBAAuB,MAAM;IAEhD,gBAAgB;IAChB,SAAS,KAAK,mBAAmB,YAAmB;gBAErB,SAAS,EAAE,qBAAqB,EAAY,gBAAgB,EAAE,OAAO;IAKpG;;;OAGG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;aAOxB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE7F,IAAW,YAAY,IAAI,eAAe,CAAuG;IAEjJ,kGAAkG;IAC3F,YAAY,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,GAAG,IAAI;IAE9E;;;;;OAKG;IACU,eAAe,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxF,gBAAgB;IAChB,SAAS,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC;IAExC,gBAAgB;IAChB,IAAW,2BAA2B,IAAI,MAAM,CAAoE;IAEpH,gBAAgB;cACA,qBAAqB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAE9E,gBAAgB;IACT,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE;IAKrD;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI;IAIzF,gBAAgB;IACT,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI;IAQ3F;;;;;;;OAOG;IACU,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzH,gBAAgB;IACH,cAAc,CAAC,YAAY,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpM,gBAAgB;IACR,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAGjD,gBAAgB;cACA,wBAAwB,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;IA0BlF;;;;OAIG;IACI,SAAS,CAAC,MAAM,EAAE,6BAA6B;IAQtD;;OAEG;IACH,SAAS,CAAC,eAAe,CAAC,UAAU,EAAE,6BAA6B;IAEnE,gBAAgB;IAChB,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO;IAMlD;;;OAGG;IACH,SAAS,CAAC,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAKxD;;;;;;OAMG;IACH,SAAS,CAAC,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI3D;;;;OAIG;IACH,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI5C,gBAAgB;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAsBxG;;;;;OAKG;IACH,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAWhD;;;;;OAKG;IACH,SAAS,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIlD;;;;;;;;;;;;OAYG;IACH,SAAS,KAAK,oBAAoB,IAAI,eAAe,GAAG,SAAS,CAEhE;IAED;;;;;;;;;;OAUG;IACH,SAAS,CAAC,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAWnF,gBAAgB;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4EpG,0DAA0D;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IA+BvG,gBAAgB;cACA,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B7E,gBAAgB;IACT,kBAAkB,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO;IAaxD;;;;OAIG;IACI,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI9C;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAK7C;;;;OAIG;IACI,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI5C;;;;OAIG;IACI,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAK5C;;;;;;;;OAQG;IACI,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW;IAkBrF;;;;;;OAMG;IACI,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAWtI,gBAAgB;IACT,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAK7E,gBAAgB;IACT,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO;IAM/G,gBAAgB;IACT,uBAAuB,CAAC,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO;IASpF;;OAEG;IACH,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM;CAQzC"}

package/lib/cjs/tile/map/MapLayerImageryProvider.js

@@ -8,6 +8,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MapLayerImageryProvider = exports.MapLayerImageryProviderStatus = void 0;
+exports.escapeHtml = escapeHtml;
+exports.tryGetOrigin = tryGetOrigin;
 const core_bentley_1 = require("@itwin/core-bentley");
 const core_common_1 = require("@itwin/core-common");
 const core_geometry_1 = require("@itwin/core-geometry");
@@ -19,6 +21,34 @@ const utils_1 = require("../../request/utils");
 const tileImageSize = 256, untiledImageSize = 256;
 const earthRadius = 6378137;
 const doDebugToolTips = false;
+/** Escapes HTML metacharacters so the text renders literally when assigned to `innerHTML`.
+ * Use for any server- or user-supplied string that ends up in the map tooltip, which is rendered
+ * as HTML by [[MapLayerTileTreeReference.getToolTip]].
+ * @internal
+ */
+function escapeHtml(text) {
+    return text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+/** Returns the origin (scheme + host + port) of the given URL, or undefined if it cannot be parsed or does
+ * not denote a distinct network origin.
+ *
+ * Only `http:` and `https:` URLs yield an origin. Every other scheme is rejected because opaque URLs
+ * — `file:`, `data:`, `about:`, `blob:null`, and the custom protocols Electron hosts commonly register —
+ * all serialize to the literal string `"null"`. Comparing those would make unrelated URLs look same-origin,
+ * so a single trusted entry could unlock all of them. Callers use this for credential-trust decisions, and
+ * returning `undefined` keeps those decisions fail-closed.
+ * @internal
+ */
+function tryGetOrigin(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    return (parsed.protocol === "http:" || parsed.protocol === "https:") ? parsed.origin : undefined;
+}
 /** The status of the map layer imagery provider that lets you know if authentication is needed to request tiles.
  * @public
  */
@@ -26,6 +56,12 @@ var MapLayerImageryProviderStatus;
 (function (MapLayerImageryProviderStatus) {
     MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["Valid"] = 0] = "Valid";
     MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["RequireAuth"] = 1] = "RequireAuth";
+    /** A request received an authentication challenge, but credentials were withheld because the request origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * The blocked origins are available via [[MapLayerImageryProvider.blockedOrigins]].
+     * @beta
+     */
+    MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["UntrustedOrigin"] = 2] = "UntrustedOrigin";
 })(MapLayerImageryProviderStatus || (exports.MapLayerImageryProviderStatus = MapLayerImageryProviderStatus = {}));
 /** Abstract class for map layer imagery providers.
  * Map layer imagery providers request and provide tile images and other data. Each map layer from a separate source needs its own imagery provider object.
@@ -43,7 +79,41 @@ class MapLayerImageryProvider {
     /** @internal */
     _status = MapLayerImageryProviderStatus.Valid;
     /** @internal */
-    _includeUserCredentials = false;
+    _blockedOrigins = new Set();
+    /** Origins of requests for which credentials were withheld because they are not trusted
+     * (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Populated when [[status]] transitions to [[MapLayerImageryProviderStatus.UntrustedOrigin]];
+     * [[onStatusChanged]] is raised again each time a new origin is added. Cleared by [[resetStatus]].
+     * @beta
+     */
+    get blockedOrigins() { return [...this._blockedOrigins]; }
+    /** Origins for which a previous SSO handshake (i.e. Windows Authentication) succeeded.
+     * Browser credentials are only included for subsequent requests targeting these origins,
+     * so that a successful handshake with one host does not leak credentials to other hosts
+     * this provider may contact.
+     * @internal
+     */
+    _ssoSucceededOrigins = new Set();
+    /** Returns true if browser credentials should be included for the given URL because a previous
+     * SSO handshake succeeded for its origin AND the origin is still allowed by the current policy
+     * (see [[MapLayerFormatRegistry.isSsoAllowed]]). Re-checking the policy ensures a handshake recorded
+     * while enforcement was disabled — or before an origin was removed from
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]] — does not keep latching credentials on.
+     * @internal
+     */
+    includeUserCredentials(url) {
+        const origin = tryGetOrigin(url);
+        return origin !== undefined && this._ssoSucceededOrigins.has(origin) && this.isSsoAllowed(url);
+    }
+    /** Records that an SSO handshake succeeded for the given URL's origin, so subsequent requests
+     * to that origin include browser credentials without going through another 401 challenge.
+     * @internal
+     */
+    recordSsoSucceeded(url) {
+        const origin = tryGetOrigin(url);
+        if (origin !== undefined)
+            this._ssoSucceededOrigins.add(origin);
+    }
     /** @internal */
     onFirstRequestCompleted = new core_bentley_1.BeEvent();
     /** @internal */
@@ -59,7 +129,17 @@ class MapLayerImageryProvider {
      * @public
      */
     get supportsMapFeatureInfo() { return false; }
-    resetStatus() { this.setStatus(MapLayerImageryProviderStatus.Valid); }
+    /** Reset the provider's status to [[MapLayerImageryProviderStatus.Valid]] and clear the list of
+     * [[blockedOrigins]] accumulated while in the [[MapLayerImageryProviderStatus.UntrustedOrigin]] state.
+     * Raises [[onStatusChanged]] if the status actually changes.
+     * Typically called after the user has provided credentials or the application has updated
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]], so that subsequent requests are re-attempted.
+     * @beta
+     */
+    resetStatus() {
+        this._blockedOrigins.clear();
+        this.setStatus(MapLayerImageryProviderStatus.Valid);
+    }
     /** @internal */
     get tileSize() { return this._usesCachedTiles ? tileImageSize : untiledImageSize; }
     /** @internal */
@@ -233,6 +313,32 @@ class MapLayerImageryProvider {
             (0, utils_1.setBasicAuthorization)(headers, this._settings.userName, this._settings.password);
         }
     }
+    /** Returns true if the given URL has the same origin as this layer's settings URL.
+     * Used to avoid leaking credentials to third-party hosts.
+     * @internal
+     */
+    matchesSettingsUrlOrigin(url) {
+        const origin = tryGetOrigin(url);
+        return origin !== undefined && origin === tryGetOrigin(this._settings.url);
+    }
+    /** Returns true if the basic-auth credentials from the layer settings may be attached to a request to the given URL.
+     * Always true unless [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled (opt-in).
+     * When enabled, the origin of this layer's settings URL is implicitly trusted (the credentials belong to that
+     * server); other origins must be listed in [[MapLayerFormatRegistry.trustedCredentialsOrigins]].
+     * See [[MapLayerFormatRegistry.isCredentialsSharingAllowed]].
+     * @internal
+     */
+    isCredentialsSharingAllowed(url) {
+        return IModelApp_1.IModelApp.mapLayerFormatRegistry.isCredentialsSharingAllowed(url, this._settings.url);
+    }
+    /** Returns true if a request to the given URL may be retried with browser credentials included
+     * (i.e. SSO / Windows Authentication) after an NTLM or Negotiate http 401 challenge.
+     * See [[MapLayerFormatRegistry.isSsoAllowed]].
+     * @internal
+     */
+    isSsoAllowed(url) {
+        return IModelApp_1.IModelApp.mapLayerFormatRegistry.isSsoAllowed(url);
+    }
     /** @internal */
     async makeTileRequest(url, timeoutMs, authorization) {
         // We want to complete the first request before letting other requests go;
@@ -252,40 +358,132 @@ class MapLayerImageryProvider {
             throw new Error("fetch call failed");
         return response;
     }
+    /** Records the given URL's origin and transitions the status to [[MapLayerImageryProviderStatus.UntrustedOrigin]].
+     * Called when a request received an authentication challenge that could not be answered because the origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Raises [[onStatusChanged]] on the status transition, and again whenever a new origin is added.
+     * @internal
+     */
+    reportBlockedOrigin(url) {
+        const origin = tryGetOrigin(url) ?? url;
+        const isNewOrigin = !this._blockedOrigins.has(origin);
+        this._blockedOrigins.add(origin);
+        if (this._status !== MapLayerImageryProviderStatus.UntrustedOrigin)
+            this.setStatus(MapLayerImageryProviderStatus.UntrustedOrigin);
+        else if (isNewOrigin)
+            this.onStatusChanged.raiseEvent(this); // status unchanged, but a new origin was blocked
+    }
+    /** Logs a warning (once per origin, app-wide) when credentials are sent to an origin that would be blocked
+     * if [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] were enabled.
+     * Helps applications discover the origins they need to whitelist before opting in to the restriction.
+     * See [[MapLayerFormatRegistry.logUntrustedOriginUse]].
+     * @internal
+     */
+    logUntrustedOriginUse(url) {
+        IModelApp_1.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(url);
+    }
+    /** The redirect policy to apply to a request that carries browser credentials (see [[includeUserCredentials]]).
+     *
+     * When [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled, redirects are refused
+     * outright (`"error"`). `fetch` cannot be asked to follow only same-origin redirects, and by the time a
+     * followed redirect can be inspected the credentials have already been delivered to the destination — so
+     * refusing is the only way to honour the guarantee that credentials reach none but the origins listed in
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]]. Legitimate same-origin redirects fail as a result;
+     * that is the cost of the opt-in restriction.
+     *
+     * When the restriction is disabled (the default), redirects are followed as before and
+     * [[checkCredentialedRedirect]] reports the destination after the fact.
+     * @internal
+     */
+    get credentialedRedirect() {
+        return IModelApp_1.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined;
+    }
+    /** Detects that a request carrying browser credentials (see [[includeUserCredentials]]) was transparently
+     * redirected to a different origin, and reports or logs that origin.
+     *
+     * This is a **best-effort, after-the-fact** signal used only while
+     * [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is disabled, where credentialed requests
+     * still follow redirects (see [[credentialedRedirect]]). It cannot prevent the exposure — the credentials
+     * have already been sent — and it does not fire at all when the destination denies CORS, because `fetch`
+     * then rejects instead of returning a `Response`. The destination origin is never latched as SSO-succeeded,
+     * so credentials do not keep flowing to it.
+     * @internal
+     */
+    checkCredentialedRedirect(requestedUrl, response) {
+        const finalOrigin = tryGetOrigin(response.url);
+        if (!response.url || finalOrigin === undefined || finalOrigin === tryGetOrigin(requestedUrl))
+            return;
+        if (!this.isSsoAllowed(response.url))
+            this.reportBlockedOrigin(response.url);
+        else
+            this.logUntrustedOriginUse(response.url); // no-op when the restriction is enabled
+    }
     /** @internal */
     async makeRequest(url, timeoutMs, authorization) {
         let response;
         let headers;
         let hasCreds = false;
+        // Whether this request had basic-auth credentials of its own to offer. Requests carrying a caller-supplied
+        // `authorization` are excluded: those bypass the origin policy entirely.
+        const hasSettingsCreds = !authorization && !!this._settings.userName && !!this._settings.password;
         if (authorization) {
             headers = new Headers();
             headers.set("Authorization", authorization);
         }
-        else if (this._settings.userName && this._settings.password) {
-            hasCreds = true;
-            headers = new Headers();
-            this.setRequestAuthorization(headers);
+        else if (hasSettingsCreds) {
+            if (this.isCredentialsSharingAllowed(url)) {
+                hasCreds = true;
+                headers = new Headers();
+                this.setRequestAuthorization(headers);
+                if (!this.matchesSettingsUrlOrigin(url))
+                    this.logUntrustedOriginUse(url);
+            }
         }
+        const includeCredentials = this.includeUserCredentials(url);
         const opts = {
             method: "GET",
             headers,
-            credentials: this._includeUserCredentials ? "include" : undefined,
+            credentials: includeCredentials ? "include" : undefined,
+            redirect: includeCredentials ? this.credentialedRedirect : undefined,
         };
         if (timeoutMs !== undefined)
             (0, utils_1.setRequestTimeout)(opts, timeoutMs);
         response = await fetch(url, opts);
+        if (includeCredentials)
+            this.checkCredentialedRedirect(url, response);
+        // fetch follows redirects transparently, so all trust decisions below target the final
+        // (post-redirect) URL reported by the response, not the URL we asked for.
+        const challengedUrl = response.url || url;
         if (response.status === 401
             && (0, utils_1.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])
-            && !this._includeUserCredentials
+            && !includeCredentials
             && !hasCreds) {
-            // Removed the previous headers and make sure "include" credentials is set
-            opts.headers = undefined;
-            opts.credentials = "include";
-            // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-            response = await fetch(url, opts);
-            if (response.status === 200) {
-                this._includeUserCredentials = true; // avoid going through 401 challenges over and over
+            if (this.isSsoAllowed(challengedUrl)) {
+                // Removed the previous headers and make sure "include" credentials is set
+                opts.headers = undefined;
+                opts.credentials = "include";
+                // A Negotiate/NTLM handshake is normally a same-URL 401 round-trip, but in legacy mode we preserve
+                // the previous behavior and allow the browser to follow redirects after the authenticated retry.
+                opts.redirect = IModelApp_1.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined;
+                this.logUntrustedOriginUse(challengedUrl);
+                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
+                response = await fetch(challengedUrl, opts);
+                if (response.status === 200) {
+                    this.recordSsoSucceeded(challengedUrl); // avoid going through 401 challenges over and over for this origin
+                }
             }
+            else {
+                this.reportBlockedOrigin(challengedUrl);
+            }
+        }
+        else if ((response.status === 401 || response.status === 403) && hasSettingsCreds && !this.isCredentialsSharingAllowed(challengedUrl)) {
+            // Some servers answer an unauthenticated request with 403 (Forbidden) rather than a 401 challenge;
+            // since this request could not present its credentials to the challenging origin, either status most
+            // likely results from that. The permission is recomputed for the challenged URL rather than reusing the
+            // decision made for the requested one: `fetch` strips the Authorization header when it follows a
+            // cross-origin redirect, so a trusted request can still arrive unauthenticated at an untrusted origin,
+            // and conversely a request that started out untrusted may end up at an origin that is trusted.
+            this.reportBlockedOrigin(challengedUrl);
         }
         return response;
     }
@@ -317,16 +515,28 @@ class MapLayerImageryProvider {
     }
     /** @internal */
     async toolTipFromUrl(strings, url) {
-        const headers = new Headers();
-        this.setRequestAuthorization(headers);
+        let headers;
+        if (this.isCredentialsSharingAllowed(url)) {
+            headers = new Headers();
+            this.setRequestAuthorization(headers);
+        }
         try {
+            const includeCredentials = this.includeUserCredentials(url);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
-                credentials: this._includeUserCredentials ? "include" : undefined,
+                credentials: includeCredentials ? "include" : undefined,
+                redirect: includeCredentials ? this.credentialedRedirect : undefined,
             });
-            const text = await response.text();
-            if (undefined !== text) {
+            if (includeCredentials)
+                this.checkCredentialedRedirect(url, response);
+            let text = await response.text();
+            if (text) {
+                // Tooltip content (e.g. WMS GetFeatureInfo responses) is rendered as HTML downstream and may
+                // deliberately contain markup; text from origins not trusted for credentials is escaped.
+                // fetch follows redirects transparently, so the text may come from a different origin than requested.
+                if (!this.isCredentialsSharingAllowed(response.url || url))
+                    text = escapeHtml(text);
                 strings.push(text);
             }
         }