MapProxy 3.1.3__tar.gz → 3.1.4__tar.gz

{MapProxy-3.1.3 → mapproxy-3.1.4}/CHANGES.txt

@@ -1,3 +1,12 @@
+3.1.4 2025-04-10
+~~~~~~~~~~~~~~~~
+
+Fixes:
+
+- Security fix to prevent XSS injections in demo pages
+- Security fix to prevent reading file urls
+
+
 3.1.3 2024-11-26
 ~~~~~~~~~~~~~~~~
 

{MapProxy-3.1.3 → mapproxy-3.1.4}/MapProxy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: MapProxy
-Version: 3.1.3
+Version: 3.1.4
 Summary: An accelerating proxy for tile and web map services
 Home-page: https://mapproxy.org
 Author: Oliver Tonnhofer
@@ -8,7 +8,6 @@ Author-email: olt@omniscale.de
 Maintainer: terrestris GmbH & Co. KG
 Maintainer-email: info@terrestris.de
 License: Apache Software License 2.0
-Platform: UNKNOWN
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
@@ -24,6 +23,25 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 License-File: COPYING.txt
 License-File: AUTHORS.txt
+Requires-Dist: PyYAML>=3.0
+Requires-Dist: future
+Requires-Dist: pyproj>=2
+Requires-Dist: jsonschema>=4
+Requires-Dist: importlib_resources; python_version <= "3.8"
+Requires-Dist: werkzeug<4
+Requires-Dist: Pillow!=2.4.0,!=8.3.0,!=8.3.1
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: requires-dist
+Dynamic: summary
 
 MapProxy is an open source proxy for geospatial data. It caches, accelerates and transforms data from existing map services and serves any desktop or web GIS client.
 
@@ -37,6 +55,15 @@ The documentation is available at: http://mapproxy.github.io/mapproxy/latest/
 
 Changes
 -------
+3.1.4 2025-04-10
+~~~~~~~~~~~~~~~~
+
+Fixes:
+
+- Security fix to prevent XSS injections in demo pages
+- Security fix to prevent reading file urls
+
+
 3.1.3 2024-11-26
 ~~~~~~~~~~~~~~~~
 
@@ -127,31 +154,7 @@ Fixes:
   - Fix gh-pages workflow
 
 
-2.2.0 2024-07-24
-~~~~~~~~~~~~~~~~
-
-Improvements:
-
-  - Add timeout to SQLite connect for geopackages. This helps against locking exceptions
-  - Improvement of documentation, typos, wrong cli commands, old python2 stuff
-  - The WMTS capabilites will now advertise the WMS GetLegendGraphic as a LegendURL if both services are active
-  - It is possible now to configure LegendURLs that should be shown in the WMTS capabilities
-  - A new method for plugins to intercept and modify requests made to MapProxy was added.
-
-Maintenance:
-
-  - Removal of debian package information
-  - Fix docs workflow
-
-Fixes:
-
-  - Remove import of the packaging library that does not appear in the `install_requires`
-  - Only install and use `importlib_resources` in python 3.8
-
-
 
 Older changes
 -------------
 See https://raw.github.com/mapproxy/mapproxy/master/CHANGES.txt
-
-

{MapProxy-3.1.3 → mapproxy-3.1.4}/MapProxy.egg-info/SOURCES.txt

@@ -485,6 +485,7 @@ mapproxy/util/__init__.py
 mapproxy/util/async_.py
 mapproxy/util/collections.py
 mapproxy/util/coverage.py
+mapproxy/util/escape.py
 mapproxy/util/fs.py
 mapproxy/util/geom.py
 mapproxy/util/lib.py

{MapProxy-3.1.3 → mapproxy-3.1.4}/MapProxy.egg-info/entry_points.txt

@@ -1,4 +1,3 @@
 [console_scripts]
 mapproxy-seed = mapproxy.seed.script:main
 mapproxy-util = mapproxy.script.util:main
-

{MapProxy-3.1.3 → mapproxy-3.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: MapProxy
-Version: 3.1.3
+Version: 3.1.4
 Summary: An accelerating proxy for tile and web map services
 Home-page: https://mapproxy.org
 Author: Oliver Tonnhofer
@@ -8,7 +8,6 @@ Author-email: olt@omniscale.de
 Maintainer: terrestris GmbH & Co. KG
 Maintainer-email: info@terrestris.de
 License: Apache Software License 2.0
-Platform: UNKNOWN
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
@@ -24,6 +23,25 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 License-File: COPYING.txt
 License-File: AUTHORS.txt
+Requires-Dist: PyYAML>=3.0
+Requires-Dist: future
+Requires-Dist: pyproj>=2
+Requires-Dist: jsonschema>=4
+Requires-Dist: importlib_resources; python_version <= "3.8"
+Requires-Dist: werkzeug<4
+Requires-Dist: Pillow!=2.4.0,!=8.3.0,!=8.3.1
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: requires-dist
+Dynamic: summary
 
 MapProxy is an open source proxy for geospatial data. It caches, accelerates and transforms data from existing map services and serves any desktop or web GIS client.
 
@@ -37,6 +55,15 @@ The documentation is available at: http://mapproxy.github.io/mapproxy/latest/
 
 Changes
 -------
+3.1.4 2025-04-10
+~~~~~~~~~~~~~~~~
+
+Fixes:
+
+- Security fix to prevent XSS injections in demo pages
+- Security fix to prevent reading file urls
+
+
 3.1.3 2024-11-26
 ~~~~~~~~~~~~~~~~
 
@@ -127,31 +154,7 @@ Fixes:
   - Fix gh-pages workflow
 
 
-2.2.0 2024-07-24
-~~~~~~~~~~~~~~~~
-
-Improvements:
-
-  - Add timeout to SQLite connect for geopackages. This helps against locking exceptions
-  - Improvement of documentation, typos, wrong cli commands, old python2 stuff
-  - The WMTS capabilites will now advertise the WMS GetLegendGraphic as a LegendURL if both services are active
-  - It is possible now to configure LegendURLs that should be shown in the WMTS capabilities
-  - A new method for plugins to intercept and modify requests made to MapProxy was added.
-
-Maintenance:
-
-  - Removal of debian package information
-  - Fix docs workflow
-
-Fixes:
-
-  - Remove import of the packaging library that does not appear in the `install_requires`
-  - Only install and use `importlib_resources` in python 3.8
-
-
 
 Older changes
 -------------
 See https://raw.github.com/mapproxy/mapproxy/master/CHANGES.txt
-
-

{MapProxy-3.1.3 → mapproxy-3.1.4}/doc/deployment.rst

@@ -49,6 +49,8 @@ Behind an HTTP server or proxy
 
 Both approaches require a configuration that maps your MapProxy configuration with the MapProxy application. You can write a small script file for that.
 
+.. note:: In production mode it is recommended to disable the demo service.
+
 .. _server_script:
 
 Server script

{MapProxy-3.1.3 → mapproxy-3.1.4}/mapproxy/config/loader.py

@@ -2446,6 +2446,10 @@ def load_configuration(mapproxy_conf, seed=False, ignore_warnings=True, renderd=
     for error in errors:
         log.warning(error)
 
+    services = conf_dict.get('services')
+    if services is not None and 'demo' in services:
+        log.warning('Application has demo page enabled. It is recommended to disable this in production.')
+
     return ProxyConfiguration(conf_dict, conf_base_dir=conf_base_dir, seed=seed,
                               renderd=renderd)
 

{MapProxy-3.1.3 → mapproxy-3.1.4}/mapproxy/multiapp.py

@@ -20,6 +20,7 @@ from mapproxy.request import Request
 from mapproxy.response import Response
 from mapproxy.util.collections import LRU
 from mapproxy.wsgiapp import make_wsgi_app as make_mapproxy_wsgi_app
+from mapproxy.util.escape import escape_html
 
 from threading import Lock
 
@@ -95,7 +96,7 @@ class MultiMapProxy(object):
         import mapproxy.version
         html = "<html><body><h1>Welcome to MapProxy %s</h1>" % mapproxy.version.version
 
-        url = req.script_url
+        url = escape_html(req.script_url)
         if self.list_apps:
             html += "<h2>available instances:</h2><ul>"
             html += '\n'.join('<li><a href="%(url)s/%(name)s/">%(name)s</a></li>' % {'url': url, 'name': app}

{MapProxy-3.1.3 → mapproxy-3.1.4}/mapproxy/service/demo.py

@@ -18,6 +18,9 @@ Demo service handler
 """
 from __future__ import division
 
+import logging
+import re
+
 try:
     import importlib_resources
 except ImportError:
@@ -30,10 +33,12 @@ from mapproxy.config.config import base_config
 from mapproxy.util.ext.odict import odict
 from mapproxy.exception import RequestError
 from mapproxy.service.base import Server
+from mapproxy.request.base import Request
 from mapproxy.response import Response
 from mapproxy.srs import SRS, get_epsg_num
 from mapproxy.layer import SRSConditional, CacheMapLayer, ResolutionConditional
 from mapproxy.source.wms import WMSSource
+from mapproxy.util.escape import escape_html
 
 from urllib import request as urllib2
 
@@ -44,6 +49,8 @@ get_template = template_loader(__package__, 'templates', namespace=env)
 # Used by plugins
 extra_demo_server_handlers = set()
 
+logger = logging.getLogger("demo")
+
 
 def register_extra_demo_server_handler(handler):
     """ Method used by plugins to register a new handler for the demo service.
@@ -106,7 +113,29 @@ class DemoServer(Server):
         self.restful_template = restful_template
         self.background = background
 
-    def handle(self, req):
+    @staticmethod
+    def get_capabilities_url(service_path: str, req: Request) -> str:
+        if 'type' in req.args and req.args['type'] == 'external':
+            url = escape_html(req.script_url) + service_path
+        else:
+            url = req.server_script_url + service_path
+        return url
+
+    @staticmethod
+    def valid_url(url: str) -> bool:
+        pattern = re.compile("^https?://")
+        if pattern.match(url):
+            return True
+        else:
+            logging.warn(f"A request was blocked that was trying to access a non-http resource: {url}")
+            return False
+
+    @staticmethod
+    def read_capabilities(url: str) -> str:
+        resp = urllib2.urlopen(url)
+        return escape_html(resp.read().decode())
+
+    def handle(self, req: Request):
         if req.path.startswith('/demo/static/'):
             if '..' in req.path:
                 return Response('file not found', content_type='text/plain', status=404)
@@ -138,56 +167,47 @@ class DemoServer(Server):
         elif 'wmts_layer' in req.args:
             demo = self._render_wmts_template('demo/wmts_demo.html', req)
         elif 'wms_capabilities' in req.args:
-            internal_url = '%s/service?REQUEST=GetCapabilities&SERVICE=WMS' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
-            else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+            url = self.get_capabilities_url('/service?REQUEST=GetCapabilities&SERVICE=WMS', req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'WMS', url)
         elif 'wmsc_capabilities' in req.args:
-            internal_url = '%s/service?REQUEST=GetCapabilities&SERVICE=WMS&tiled=true' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
-            else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+            url = self.get_capabilities_url('/service?REQUEST=GetCapabilities&SERVICE=WMS&tiled=true', req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'WMS-C', url)
         elif 'wmts_capabilities_kvp' in req.args:
-            internal_url = '%s/service?REQUEST=GetCapabilities&SERVICE=WMTS' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
-            else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+            url = self.get_capabilities_url('/service?REQUEST=GetCapabilities&SERVICE=WMTS', req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'WMTS', url)
         elif 'wmts_capabilities' in req.args:
-            internal_url = '%s/wmts/1.0.0/WMTSCapabilities.xml' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
-            else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+            url = self.get_capabilities_url('/wmts/1.0.0/WMTSCapabilities.xml', req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'WMTS', url)
         elif 'tms_capabilities' in req.args:
             if 'layer' in req.args and 'srs' in req.args:
-                # prevent dir traversal (seems it's not possible with urllib2, but better safe then sorry)
-                layer = req.args['layer'].replace('..', '')
-                srs = req.args['srs'].replace('..', '')
-                internal_url = '%s/tms/1.0.0/%s/%s' % (req.server_script_url, layer, srs)
-            else:
-                internal_url = '%s/tms/1.0.0/' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
+                # prevent dir traversal (seems it's not possible with urllib2, but better safe than sorry)
+                layer = escape_html(req.args['layer'].replace('..', ''))
+                srs = escape_html(req.args['srs'].replace('..', ''))
+                service_path = f'/tms/1.0.0/{layer}/{srs}'
             else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+                service_path = '/tms/1.0.0/'
+            url = self.get_capabilities_url(service_path, req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'TMS', url)
         elif req.path == '/demo/':
             demo = self._render_template(req, 'demo/demo.html')
         else:
             resp = Response('', status=301)
-            resp.headers['Location'] = req.script_url.rstrip('/') + '/demo/'
+            resp.headers['Location'] = escape_html(req.script_url).rstrip('/') + '/demo/'
             return resp
         return Response(demo, content_type='text/html')
 
@@ -258,7 +278,7 @@ class DemoServer(Server):
     def _render_wms_template(self, template, req):
         template = get_template(template, default_inherit="demo/static.html")
         layer = self.layers[req.args['wms_layer']]
-        srs = escape(req.args['srs'])
+        srs = escape_html(req.args['srs'])
         bbox = layer.extent.bbox_for(SRS(srs))
         width = bbox[2] - bbox[0]
         height = bbox[3] - bbox[1]
@@ -268,7 +288,7 @@ class DemoServer(Server):
             background_url = self.background["url"]
         return template.substitute(layer=layer,
                                    image_formats=self.image_formats,
-                                   format=escape(req.args['format']),
+                                   format=escape_html(req.args['format']),
                                    srs=srs,
                                    layer_srs=self.layer_srs,
                                    bbox=bbox,
@@ -301,8 +321,8 @@ class DemoServer(Server):
         if self.background:
             background_url = self.background["url"]
         return template.substitute(layer=tile_layer,
-                                   srs=escape(req.args['srs']),
-                                   format=escape(req.args['format']),
+                                   srs=escape_html(req.args['srs']),
+                                   format=escape_html(req.args['format']),
                                    resolutions=res,
                                    units=units,
                                    add_res_to_options=add_res_to_options,
@@ -330,8 +350,8 @@ class DemoServer(Server):
             background_url = self.background["url"]
         return template.substitute(layer=wmts_layer,
                                    matrix_set=wmts_layer.grid.name,
-                                   format=escape(req.args['format']),
-                                   srs=escape(req.args['srs']),
+                                   format=escape_html(req.args['format']),
+                                   srs=escape_html(req.args['srs']),
                                    resolutions=wmts_layer.grid.resolutions,
                                    units=units,
                                    all_tile_layers=self.tile_layers,
@@ -353,15 +373,3 @@ class DemoServer(Server):
                 return True
             return False
         return True
-
-
-def escape(data):
-    """
-    Escape user-provided input data for safe inclusion in HTML _and_ JS to prevent XSS.
-    """
-    data = data.replace('&', '&')
-    data = data.replace('>', '>')
-    data = data.replace('<', '&lt;')
-    data = data.replace("'", '')
-    data = data.replace('"', '')
-    return data

{MapProxy-3.1.3 → mapproxy-3.1.4}/mapproxy/service/kml.py

@@ -21,6 +21,7 @@ from mapproxy.service.base import Server
 from mapproxy.request.tile import TileRequest
 from mapproxy.srs import SRS
 from mapproxy.util.coverage import load_limited_to
+from mapproxy.util.escape import escape_html
 
 
 class KMLRequest(TileRequest):
@@ -182,7 +183,7 @@ class KMLServer(Server):
 
         subtiles = self._get_subtiles(map_request, layer)
         tile_size = layer.grid.tile_size[0]
-        url = map_request.http.script_url.rstrip('/')
+        url = escape_html(map_request.http.script_url.rstrip('/'))
         result = KMLRenderer().render(
             tile=tile, subtiles=subtiles, layer=layer, url=url, name=map_request.layer, format=layer.format,
             name_path=layer.md['name_path'], initial_level=initial_level, tile_size=tile_size)

{MapProxy-3.1.3 → mapproxy-3.1.4}/mapproxy/service/templates/demo/capabilities_demo.html

@@ -11,8 +11,6 @@ jscript_functions = None
             <h2>{{service}} GetCapabilities</h2>
             <a href="{{url}}">{{url}}</a>
             <pre>
-{{for line in capabilities}}
-{{escape(wrapper.fill(line.decode('utf8')))}}
-{{endfor}}
+{{capabilities}}
             </pre>
 

{MapProxy-3.1.3 → mapproxy-3.1.4}/mapproxy/test/system/fixture/util_grids.yaml

@@ -1,5 +1,6 @@
 services:
-    demo:
+    wms:
+
 layers:
     - name: grid_layer
       title: Grid Layer

mapproxy-3.1.4/mapproxy/test/system/test_demo.py

@@ -0,0 +1,123 @@
+# This file is part of the MapProxy project.
+# Copyright (C) 2022 Even Rouault
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import re
+import pytest
+
+from mapproxy.test.http import mock_httpd
+from mapproxy.test.system import SysTest
+from webtest import AppError
+
+
+@pytest.fixture(scope="module")
+def config_file():
+    return "demo.yaml"
+
+
+class TestDemo(SysTest):
+
+    def test_basic(self, app):
+        resp = app.get("/demo/", status=200)
+        assert resp.content_type == "text/html"
+        assert 'href="../service?REQUEST=GetCapabilities&SERVICE=WMS"' in resp
+        assert 'href="../service?REQUEST=GetCapabilities&SERVICE=WMS&tiled=true"' in resp
+        assert 'href="../demo/?wmts_layer=wms_cache&format=jpeg&srs=EPSG%3A900913"' in resp
+        assert 'href="../demo/?tms_layer=wms_cache&format=jpeg&srs=EPSG%3A900913"' in resp
+
+    def test_previewmap(self, app):
+        resp = app.get("/demo/?srs=EPSG%3A3857&format=image%2Fpng&wms_layer=wms_cache", status=200)
+        assert resp.content_type == "text/html"
+        assert '<h2>Layer Preview - wms_cache</h2>' in resp
+
+    def test_layers_sorted_by_name(self, app):
+        resp = app.get("/demo/", status=200)
+
+        patternTable = re.compile(r'<table class="code">.*?</table>', re.DOTALL)
+        patternWMS = r'<td\s+rowspan="2">([\w\d-]+)</td>'
+        patternWMTS_TBS = r'<td\s+rowspan="1">([\w\d-]+)</td>'
+        tables = patternTable.findall(resp.text)
+
+        layersWMS = re.findall(patternWMS, resp.text, re.IGNORECASE)
+        layersWMTS = re.findall(patternWMTS_TBS, tables[1], re.IGNORECASE)
+        layersTBS = re.findall(patternWMTS_TBS, tables[2], re.IGNORECASE)
+
+        assert layersWMS == sorted(layersWMS)
+        assert layersWMTS == sorted(layersWMTS)
+        assert layersTBS == sorted(layersTBS)
+
+    def test_external(self, app):
+        expected_req = (
+            {
+                "path": r"/path/service?REQUEST=GetCapabilities&SERVICE=WMS"
+            },
+            {"body": b"test-string", "headers": {"content-type": "text/xml"}}
+        )
+        with mock_httpd(
+                ("localhost", 42423), [expected_req]
+        ):
+            resp = app.get('/demo/?wms_capabilities&type=external', extra_environ={
+                'HTTP_X_FORWARDED_HOST': 'localhost:42423/path'
+            })
+            content = resp.text
+            assert 'test-string' in content
+            assert 'http://localhost:42423/path/service?REQUEST=GetCapabilities&SERVICE=WMS' in content
+
+    def test_external_xss_injection(self, app):
+        expected_req = (
+            {
+                "path": r"/path/&gt;&lt;script&gt;alert(XSS)&lt;/script&gt;/service?REQUEST=GetCapabilities&SERVICE=WMS"
+            },
+            {"body": b"test-string", "headers": {"content-type": "text/xml"}}
+        )
+
+        with mock_httpd(
+                ("localhost", 42423), [expected_req]
+        ):
+            resp = app.get('/demo/?wms_capabilities&type=external', extra_environ={
+                'HTTP_X_FORWARDED_HOST': 'localhost:42423/path/"><script>alert(\'XSS\')</script>'
+            })
+        content = resp.text
+        assert 'test-string' in content
+        assert '"><script>alert(\'XSS\')' not in content
+        assert '&gt;&lt;script&gt;alert(XSS)&lt;/script&gt;' in content
+
+    def test_external_file_protocol(self, app):
+        try:
+            app.get('/demo/?wms_capabilities&type=external', extra_environ={
+                'HTTP_X_FORWARDED_PROTO': 'file'
+            })
+        except AppError as e:
+            assert '400 Bad Request' in e.args[0]
+
+    def test_tms_layer_xss(self, app):
+        expected_req = (
+            {
+                "path": r"/tms/1.0.0/osm&gt;&lt;script&gt;alert(XSS)&lt;/script&gt;/1.0.0"
+            },
+            {"body": b"test-string", "headers": {"content-type": "text/xml"}}
+        )
+
+        with mock_httpd(
+                ("localhost", 42423), [expected_req]
+        ):
+            resp = app.get(
+                '/demo/?tms_capabilities&layer=osm"><script>alert(\'XSS\')</script>&type=external&srs=1.0.0',
+                extra_environ={
+                    'HTTP_X_FORWARDED_HOST': 'localhost:42423'
+                }
+            )
+        content = resp.text
+        assert '"><script>alert(\'XSS\')' not in content
+        assert '&gt;&lt;script&gt;alert(XSS)&lt;/script&gt;' in content

mapproxy-3.1.4/mapproxy/util/escape.py

@@ -0,0 +1,10 @@
+def escape_html(data):
+    """
+    Escape user-provided input data for safe inclusion in HTML _and_ JS to prevent XSS.
+    """
+    data = data.replace('&', '&')
+    data = data.replace('>', '>')
+    data = data.replace('<', '&lt;')
+    data = data.replace("'", '')
+    data = data.replace('"', '')
+    return data

{MapProxy-3.1.3 → mapproxy-3.1.4}/mapproxy/wsgiapp.py

@@ -34,6 +34,7 @@ from mapproxy.request import Request
 from mapproxy.response import Response
 from mapproxy.config import local_base_config
 from mapproxy.config.loader import load_configuration, ConfigurationError
+from mapproxy.util.escape import escape_html
 
 log = logging.getLogger('mapproxy.config')
 log_wsgiapp = logging.getLogger('mapproxy.wsgiapp')
@@ -164,7 +165,7 @@ class MapProxyApp(object):
                             resp = Response('internal error', status=500)
             if resp is None:
                 if req.path in ('', '/'):
-                    resp = self.welcome_response(req.script_url)
+                    resp = self.welcome_response(escape_html(req.script_url))
                 else:
                     resp = Response('not found', mimetype='text/plain', status=404)
             return resp(environ, start_response)

{MapProxy-3.1.3 → mapproxy-3.1.4}/setup.py

@@ -63,7 +63,7 @@ def long_description(changelog_releases=10):
 
 setup(
     name='MapProxy',
-    version="3.1.3",
+    version="3.1.4",
     description='An accelerating proxy for tile and web map services',
     long_description=long_description(7),
     long_description_content_type='text/x-rst',