MapProxy 4.0.0__tar.gz → 4.0.2__tar.gz

{mapproxy-4.0.0 → mapproxy-4.0.2}/CHANGES.txt

@@ -1,3 +1,24 @@
+4.0.2 2025-04-10
+~~~~~~~~~~~~~~~~
+
+Fixes:
+
+- Security fix to prevent XSS injections in demo pages
+- Security fix to prevent reading file urls
+
+
+4.0.1 2025-03-25
+~~~~~~~~~~~~~~~~
+
+Improvements:
+
+  - Added docs regarding OGC API support
+
+Fixes:
+
+  - WMTS Demo now works if kvp is disabled
+
+
 4.0.0 2025-03-21
 ~~~~~~~~~~~~~~~~
 

{mapproxy-4.0.0 → mapproxy-4.0.2}/MapProxy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: MapProxy
-Version: 4.0.0
+Version: 4.0.2
 Summary: An accelerating proxy for tile and web map services
 Home-page: https://mapproxy.org
 Author: Oliver Tonnhofer
@@ -53,6 +53,27 @@ The documentation is available at: http://mapproxy.github.io/mapproxy/latest/
 
 Changes
 -------
+4.0.2 2025-04-10
+~~~~~~~~~~~~~~~~
+
+Fixes:
+
+- Security fix to prevent XSS injections in demo pages
+- Security fix to prevent reading file urls
+
+
+4.0.1 2025-03-25
+~~~~~~~~~~~~~~~~
+
+Improvements:
+
+  - Added docs regarding OGC API support
+
+Fixes:
+
+  - WMTS Demo now works if kvp is disabled
+
+
 4.0.0 2025-03-21
 ~~~~~~~~~~~~~~~~
 
@@ -143,38 +164,6 @@ Fixes:
   - Fix transparency in TMS demo page.
 
 
-3.0.1 2024-08-27
-~~~~~~~~~~~~~~~~
-
-Fixes:
-
-  - Fix capabilities links in demo page and config template
-  - Trivy report format
-
-
-3.0.0 2024-08-27
-~~~~~~~~~~~~~~~~
-
-Breaking:
-
-  - Add proper XML Exception when service parameter disabled / invalid or missing
-    In the past MapProxy returned WMS Capabilities when no explicit service parameter was given in
-    GetCapabilities requests. With this change, an OGC exception will be returned instead.
-    Invalid service types now also return a proper exception instead of an `internal error`.
-    Besides, the status code of exception responses now have a 400 or 500 code instead of 200
-    for better conformity.
-
-Maintenance:
-
-  - Add test for seeding sqlite cache
-  - Documentation updates and clarifications
-  - Dependency updates
-
-Fixes:
-
-  - Fix gh-pages workflow
-
-
 
 Older changes
 -------------

{mapproxy-4.0.0 → mapproxy-4.0.2}/MapProxy.egg-info/SOURCES.txt

@@ -34,6 +34,7 @@ doc/install_windows.rst
 doc/labeling.rst
 doc/mapproxy_util.rst
 doc/mapproxy_util_autoconfig.rst
+doc/ogc_api.rst
 doc/plugins.rst
 doc/seed.rst
 doc/services.rst
@@ -483,6 +484,7 @@ mapproxy/util/__init__.py
 mapproxy/util/async_.py
 mapproxy/util/collections.py
 mapproxy/util/coverage.py
+mapproxy/util/escape.py
 mapproxy/util/fs.py
 mapproxy/util/geom.py
 mapproxy/util/lib.py

{mapproxy-4.0.0 → mapproxy-4.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: MapProxy
-Version: 4.0.0
+Version: 4.0.2
 Summary: An accelerating proxy for tile and web map services
 Home-page: https://mapproxy.org
 Author: Oliver Tonnhofer
@@ -53,6 +53,27 @@ The documentation is available at: http://mapproxy.github.io/mapproxy/latest/
 
 Changes
 -------
+4.0.2 2025-04-10
+~~~~~~~~~~~~~~~~
+
+Fixes:
+
+- Security fix to prevent XSS injections in demo pages
+- Security fix to prevent reading file urls
+
+
+4.0.1 2025-03-25
+~~~~~~~~~~~~~~~~
+
+Improvements:
+
+  - Added docs regarding OGC API support
+
+Fixes:
+
+  - WMTS Demo now works if kvp is disabled
+
+
 4.0.0 2025-03-21
 ~~~~~~~~~~~~~~~~
 
@@ -143,38 +164,6 @@ Fixes:
   - Fix transparency in TMS demo page.
 
 
-3.0.1 2024-08-27
-~~~~~~~~~~~~~~~~
-
-Fixes:
-
-  - Fix capabilities links in demo page and config template
-  - Trivy report format
-
-
-3.0.0 2024-08-27
-~~~~~~~~~~~~~~~~
-
-Breaking:
-
-  - Add proper XML Exception when service parameter disabled / invalid or missing
-    In the past MapProxy returned WMS Capabilities when no explicit service parameter was given in
-    GetCapabilities requests. With this change, an OGC exception will be returned instead.
-    Invalid service types now also return a proper exception instead of an `internal error`.
-    Besides, the status code of exception responses now have a 400 or 500 code instead of 200
-    for better conformity.
-
-Maintenance:
-
-  - Add test for seeding sqlite cache
-  - Documentation updates and clarifications
-  - Dependency updates
-
-Fixes:
-
-  - Fix gh-pages workflow
-
-
 
 Older changes
 -------------

{mapproxy-4.0.0 → mapproxy-4.0.2}/doc/deployment.rst

@@ -49,6 +49,8 @@ Behind an HTTP server or proxy
 
 Both approaches require a configuration that maps your MapProxy configuration with the MapProxy application. You can write a small script file for that.
 
+.. note:: In production mode it is recommended to disable the demo service.
+
 .. _server_script:
 
 Server script

{mapproxy-4.0.0 → mapproxy-4.0.2}/doc/index.rst

@@ -27,6 +27,7 @@ MapProxy Documentation
    mapproxy_util_autoconfig
    deployment
    configuration_examples
+   ogc_api
    inspire
    labeling
    auth

{mapproxy-4.0.0 → mapproxy-4.0.2}/doc/install_docker.rst

@@ -25,15 +25,13 @@ base images for implementing custom setups. As they have no WebServer running th
 The images ending with ``-dev``, start the integrated webserver mapproxy provides through
 ``mapproxy-util serve-develop``. These should not be used in a production environment!
 
-The images ending with ``-nginx``, come bundled with a preconfigured `nginx`_ HTTP Server, that lets you use MapProxy
-instantly in a production environment.
+The images ending with ``-nginx``, come bundled with a preconfigured `nginx <https://nginx.org/>`_ HTTP Server, that
+lets you use MapProxy instantly in a production environment.
 
 See the quickstart section below for a configuration / example on how to use those images.
 
-There are also several unofficial Docker images available on `Docker Hub`_ that provide ready-to-use containers for
-MapProxy.
-
-.. _`Docker Hub`: https://hub.docker.com/search?q=mapproxy
+There are also several unofficial Docker images available on `Docker Hub <https://hub.docker.com/search?q=mapproxy>`_
+that provide ready-to-use containers forMapProxy.
 
 The community has very good experiences with the following ones:
 
@@ -50,7 +48,7 @@ Quickstart
 ----------
 
 The mapproxy repository includes an `example docker compose file <https://github.com/mapproxy/mapproxy/blob/master/docker-compose.yaml>`_
- that you can use to run one of the images or as a reference for the most commonly used options.
+that you can use to run one of the images or as a reference for the most commonly used options.
 
 Create a directory (e.g. `mapproxyconfig`) for your configuration files. Put your configs into that folder.
 If you do not supply a mapproxy config file the image will create a default seed.yaml and mapproxy.yaml for you.
@@ -80,17 +78,16 @@ Volume-Mounts
 - ``/mapproxy/config/mapproxy.yaml``: MapProxy Config
 - ``/mapproxy/config/logging.ini``: Logging-Configuration
 - ``/mapproxy/config/cache_data``: Cache Data dir. Make sure that this directory is writable for the mapproxy image.
-    This can be achieved with `chmod -R a+r cache_data`
+This can be achieved with `chmod -R a+r cache_data`
 
 
 Environment Variables
 ~~~~~~~~~~~~~~~~~~~~~
 
 - ``MULTIAPP_MAPPROXY``: **This can only be used in nginx images.** If set to ``true``, MapProxy will start in multi app
-    mode and will run all configurations in the ``/mapproxy/config/apps`` directory as different apps. Default
-    is ``false``.
+mode and will run all configurations in the ``/mapproxy/config/apps`` directory as different apps. Default is ``false``.
 - ``MULTIAPP_ALLOW_LISTINGS``: In multi app mode if set to ``true``, MapProxy lists all available apps on the root page.
-    Default is ``false``.
+Default is ``false``.
 
 
 Build your own image

mapproxy-4.0.2/doc/ogc_api.rst

@@ -0,0 +1,12 @@
+OGC API Support
+===============
+
+MapProxy does not support the OGC APIs natively. There are ways to combine MapProxy with pygeoapi via docker to be able
+to use MapProxy through the OGC API of pygeoapi. An example project exists here:
+https://github.com/mapproxy/mapproxy-pygeoapi-example.
+
+Call for sponsors
+-----------------
+
+This feature is important to make MapProxy future-proof and it is desirable to integrate OGC APIs directly into
+MapProxy. If you are interested in sponsoring this feature please contact sales@terrestris.de.

{mapproxy-4.0.0 → mapproxy-4.0.2}/mapproxy/config/loader.py

@@ -2159,7 +2159,6 @@ class ServiceConfiguration(ConfigurationBase):
             creator = getattr(self, service_name + '_service', None)
             if not creator:
                 # If not a known service, try to use the plugin mechanism
-                global plugin_services
                 creator = plugin_services.get(service_name, None)
                 if not creator:
                     raise ValueError('unknown service: %s' % service_name)
@@ -2349,12 +2348,9 @@ class ServiceConfiguration(ConfigurationBase):
             kvp = wmts_conf.get('kvp')
             restful = wmts_conf.get('restful')
 
-            if kvp is None and restful is None:
-                kvp = restful = True
-
-            if kvp:
+            if kvp or kvp is None:
                 services.append('wmts_kvp')
-            if restful:
+            if restful or restful is None:
                 services.append('wmts_restful')
 
         if 'wms' in self.context.services.conf:
@@ -2412,6 +2408,10 @@ def load_configuration(mapproxy_conf, seed=False, ignore_warnings=True, renderd=
     for error in errors:
         log.warning(error)
 
+    services = conf_dict.get('services')
+    if services is not None and 'demo' in services:
+        log.warning('Application has demo page enabled. It is recommended to disable this in production.')
+
     return ProxyConfiguration(conf_dict, conf_base_dir=conf_base_dir, seed=seed,
                               renderd=renderd)
 

{mapproxy-4.0.0 → mapproxy-4.0.2}/mapproxy/multiapp.py

@@ -20,6 +20,7 @@ from mapproxy.request import Request
 from mapproxy.response import Response
 from mapproxy.util.collections import LRU
 from mapproxy.wsgiapp import make_wsgi_app as make_mapproxy_wsgi_app
+from mapproxy.util.escape import escape_html
 
 from threading import Lock
 
@@ -95,7 +96,7 @@ class MultiMapProxy(object):
         import mapproxy.version
         html = "<html><body><h1>Welcome to MapProxy %s</h1>" % mapproxy.version.version
 
-        url = req.script_url
+        url = escape_html(req.script_url)
         if self.list_apps:
             html += "<h2>available instances:</h2><ul>"
             html += '\n'.join('<li><a href="%(url)s/%(name)s/">%(name)s</a></li>' % {'url': url, 'name': app}

{mapproxy-4.0.0 → mapproxy-4.0.2}/mapproxy/service/demo.py

@@ -18,6 +18,9 @@ Demo service handler
 """
 from __future__ import division
 
+import logging
+import re
+
 try:
     import importlib_resources
 except ImportError:
@@ -30,10 +33,12 @@ from mapproxy.config.config import base_config
 from mapproxy.util.ext.odict import odict
 from mapproxy.exception import RequestError
 from mapproxy.service.base import Server
+from mapproxy.request.base import Request
 from mapproxy.response import Response
 from mapproxy.srs import SRS, get_epsg_num
 from mapproxy.layer import SRSConditional, CacheMapLayer, ResolutionConditional
 from mapproxy.source.wms import WMSSource
+from mapproxy.util.escape import escape_html
 
 from urllib import request as urllib2
 
@@ -44,6 +49,8 @@ get_template = template_loader(__package__, 'templates', namespace=env)
 # Used by plugins
 extra_demo_server_handlers = set()
 
+logger = logging.getLogger("demo")
+
 
 def register_extra_demo_server_handler(handler):
     """ Method used by plugins to register a new handler for the demo service.
@@ -106,7 +113,29 @@ class DemoServer(Server):
         self.restful_template = restful_template
         self.background = background
 
-    def handle(self, req):
+    @staticmethod
+    def get_capabilities_url(service_path: str, req: Request) -> str:
+        if 'type' in req.args and req.args['type'] == 'external':
+            url = escape_html(req.script_url) + service_path
+        else:
+            url = req.server_script_url + service_path
+        return url
+
+    @staticmethod
+    def valid_url(url: str) -> bool:
+        pattern = re.compile("^https?://")
+        if pattern.match(url):
+            return True
+        else:
+            logging.warn(f"A request was blocked that was trying to access a non-http resource: {url}")
+            return False
+
+    @staticmethod
+    def read_capabilities(url: str) -> str:
+        resp = urllib2.urlopen(url)
+        return escape_html(resp.read().decode())
+
+    def handle(self, req: Request):
         if req.path.startswith('/demo/static/'):
             if '..' in req.path:
                 return Response('file not found', content_type='text/plain', status=404)
@@ -138,56 +167,47 @@ class DemoServer(Server):
         elif 'wmts_layer' in req.args:
             demo = self._render_wmts_template('demo/wmts_demo.html', req)
         elif 'wms_capabilities' in req.args:
-            internal_url = '%s/service?REQUEST=GetCapabilities&SERVICE=WMS' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
-            else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+            url = self.get_capabilities_url('/service?REQUEST=GetCapabilities&SERVICE=WMS', req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'WMS', url)
         elif 'wmsc_capabilities' in req.args:
-            internal_url = '%s/service?REQUEST=GetCapabilities&SERVICE=WMS&tiled=true' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
-            else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+            url = self.get_capabilities_url('/service?REQUEST=GetCapabilities&SERVICE=WMS&tiled=true', req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'WMS-C', url)
         elif 'wmts_capabilities_kvp' in req.args:
-            internal_url = '%s/service?REQUEST=GetCapabilities&SERVICE=WMTS' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
-            else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+            url = self.get_capabilities_url('/service?REQUEST=GetCapabilities&SERVICE=WMTS', req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'WMTS', url)
         elif 'wmts_capabilities' in req.args:
-            internal_url = '%s/wmts/1.0.0/WMTSCapabilities.xml' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
-            else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+            url = self.get_capabilities_url('/wmts/1.0.0/WMTSCapabilities.xml', req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'WMTS', url)
         elif 'tms_capabilities' in req.args:
             if 'layer' in req.args and 'srs' in req.args:
-                # prevent dir traversal (seems it's not possible with urllib2, but better safe then sorry)
-                layer = req.args['layer'].replace('..', '')
-                srs = req.args['srs'].replace('..', '')
-                internal_url = '%s/tms/1.0.0/%s/%s' % (req.server_script_url, layer, srs)
+                # prevent dir traversal (seems it's not possible with urllib2, but better safe than sorry)
+                layer = escape_html(req.args['layer'].replace('..', ''))
+                srs = escape_html(req.args['srs'].replace('..', ''))
+                service_path = f'/tms/1.0.0/{layer}/{srs}'
             else:
-                internal_url = '%s/tms/1.0.0/' % (req.server_script_url)
-            if 'type' in req.args and req.args['type'] == 'external':
-                url = internal_url.replace(req.server_script_url, req.script_url)
-            else:
-                url = internal_url
-            capabilities = urllib2.urlopen(url)
+                service_path = '/tms/1.0.0/'
+            url = self.get_capabilities_url(service_path, req)
+            if not self.valid_url(url):
+                return Response('bad request', content_type='text/plain', status=400)
+            capabilities = self.read_capabilities(url)
             demo = self._render_capabilities_template('demo/capabilities_demo.html', capabilities, 'TMS', url)
         elif req.path == '/demo/':
             demo = self._render_template(req, 'demo/demo.html')
         else:
             resp = Response('', status=301)
-            resp.headers['Location'] = req.script_url.rstrip('/') + '/demo/'
+            resp.headers['Location'] = escape_html(req.script_url).rstrip('/') + '/demo/'
             return resp
         return Response(demo, content_type='text/html')
 
@@ -258,7 +278,7 @@ class DemoServer(Server):
     def _render_wms_template(self, template, req):
         template = get_template(template, default_inherit="demo/static.html")
         layer = self.layers[req.args['wms_layer']]
-        srs = escape(req.args['srs'])
+        srs = escape_html(req.args['srs'])
         bbox = layer.extent.bbox_for(SRS(srs))
         width = bbox[2] - bbox[0]
         height = bbox[3] - bbox[1]
@@ -268,7 +288,7 @@ class DemoServer(Server):
             background_url = self.background["url"]
         return template.substitute(layer=layer,
                                    image_formats=self.image_formats,
-                                   format=escape(req.args['format']),
+                                   format=escape_html(req.args['format']),
                                    srs=srs,
                                    layer_srs=self.layer_srs,
                                    bbox=bbox,
@@ -301,8 +321,8 @@ class DemoServer(Server):
         if self.background:
             background_url = self.background["url"]
         return template.substitute(layer=tile_layer,
-                                   srs=escape(req.args['srs']),
-                                   format=escape(req.args['format']),
+                                   srs=escape_html(req.args['srs']),
+                                   format=escape_html(req.args['format']),
                                    resolutions=res,
                                    units=units,
                                    add_res_to_options=add_res_to_options,
@@ -317,6 +337,8 @@ class DemoServer(Server):
                 wmts_layer = layer
                 break
 
+        rest_enabled = 'wmts_restful' in self.services
+
         restful_url = self.restful_template.replace('{Layer}', wmts_layer.name, 1)
         if '{Format}' in restful_url:
             restful_url = restful_url.replace('{Format}', wmts_layer.format)
@@ -330,11 +352,12 @@ class DemoServer(Server):
             background_url = self.background["url"]
         return template.substitute(layer=wmts_layer,
                                    matrix_set=wmts_layer.grid.name,
-                                   format=escape(req.args['format']),
-                                   srs=escape(req.args['srs']),
+                                   format=escape_html(req.args['format']),
+                                   srs=escape_html(req.args['srs']),
                                    resolutions=wmts_layer.grid.resolutions,
                                    units=units,
                                    all_tile_layers=self.tile_layers,
+                                   rest_enabled=rest_enabled,
                                    restful_url=restful_url,
                                    background_url=background_url)
 
@@ -353,15 +376,3 @@ class DemoServer(Server):
                 return True
             return False
         return True
-
-
-def escape(data):
-    """
-    Escape user-provided input data for safe inclusion in HTML _and_ JS to prevent XSS.
-    """
-    data = data.replace('&', '&')
-    data = data.replace('>', '>')
-    data = data.replace('<', '&lt;')
-    data = data.replace("'", '')
-    data = data.replace('"', '')
-    return data

{mapproxy-4.0.0 → mapproxy-4.0.2}/mapproxy/service/kml.py

@@ -21,6 +21,7 @@ from mapproxy.service.base import Server
 from mapproxy.request.tile import TileRequest
 from mapproxy.srs import SRS
 from mapproxy.util.coverage import load_limited_to
+from mapproxy.util.escape import escape_html
 
 
 class KMLRequest(TileRequest):
@@ -182,7 +183,7 @@ class KMLServer(Server):
 
         subtiles = self._get_subtiles(map_request, layer)
         tile_size = layer.grid.tile_size[0]
-        url = map_request.http.script_url.rstrip('/')
+        url = escape_html(map_request.http.script_url.rstrip('/'))
         result = KMLRenderer().render(
             tile=tile, subtiles=subtiles, layer=layer, url=url, name=map_request.layer, format=layer.format,
             name_path=layer.md['name_path'], initial_level=initial_level, tile_size=tile_size)

{mapproxy-4.0.0 → mapproxy-4.0.2}/mapproxy/service/templates/demo/capabilities_demo.html

@@ -11,8 +11,6 @@ jscript_functions = None
             <h2>{{service}} GetCapabilities</h2>
             <a href="{{url}}">{{url}}</a>
             <pre>
-{{for line in capabilities}}
-{{escape(wrapper.fill(line.decode('utf8')))}}
-{{endfor}}
+{{capabilities}}
             </pre>
 

{mapproxy-4.0.0 → mapproxy-4.0.2}/mapproxy/service/templates/demo/wmts_demo.html

@@ -46,13 +46,14 @@ jscript_functions=None
         const projection = ol.proj.get(srs);
 
         const source = new ol.source.WMTS({
-            url: '../service?',
+            url: {{if rest_enabled}}'../wmts{{restful_url}}'{{else}}'../service?'{{endif}},
             layer: "{{layer.name}}",
             matrixSet: '{{matrix_set}}',
             format: "{{format}}",
             projection: "{{srs}}",
             transparent: transparent,
             style: '',
+            {{if rest_enabled}}requestEncoding: 'REST',{{endif}}
             tileGrid: new ol.tilegrid.WMTS({
                 origin: ol.extent.getTopLeft(grid_extent),
                 resolutions: resolutions,

{mapproxy-4.0.0 → mapproxy-4.0.2}/mapproxy/service/wmts.py

@@ -184,7 +184,7 @@ class WMTSServer(Server):
             if result['authorized'] == 'unauthenticated':
                 raise RequestError('unauthorized', status=401)
             if result['authorized'] == 'full':
-                return self.layers.values()
+                return list(self.layers.values())
             if result['authorized'] == 'none':
                 raise RequestError('forbidden', status=403)
             allowed_layers = []
@@ -193,7 +193,7 @@ class WMTSServer(Server):
                     allowed_layers.append(layer)
             return allowed_layers
         else:
-            return self.layers.values()
+            return list(self.layers.values())
 
     def check_request(self, request, info_formats=None):
         request.make_request()

{mapproxy-4.0.0 → mapproxy-4.0.2}/mapproxy/test/system/fixture/util_grids.yaml

@@ -1,5 +1,6 @@
 services:
-    demo:
+    wms:
+
 layers:
     - name: grid_layer
       title: Grid Layer