maptiler/tileserver-gl
1
0
Fork 0
mirror of https://github.com/maptiler/tileserver-gl.git synced 2024-09-20 08:18:48 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix reflected XSS in 'key' parameter. Fixes #461

Browse Source
This commit is contained in:
Daniel Korp 2020-07-02 09:30:33 +02:00
parent a5a8ae1e95
commit 10431d70d0
No known key found for this signature in database
GPG Key ID: 1FA328D343D7DEA0
3 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/serve_style.js
View File

@ -17,7 +17,7 @@ const fixUrl = (req, url, publicUrl, opt_nokey) => {
}
const queryParams = [];
if (!opt_nokey && req.query.key) {
queryParams.unshift(`key=${req.query.key}`);
queryParams.unshift(`key=${encodeURIComponent(req.query.key)}`);
}
let query = '';
if (queryParams.length) {

6
src/server.js
View File

@ -243,7 +243,7 @@ function start(opts) {
app.get('/styles.json', (req, res, next) => {
const result = [];
const query = req.query.key ? (`?key=${req.query.key}`) : '';
const query = req.query.key ? (`?key=${encodeURIComponent(req.query.key)}`) : '';
for (const id of Object.keys(serving.styles)) {
const styleJSON = serving.styles[id].styleJSON;
result.push({
@ -319,8 +319,8 @@ function start(opts) {
data['public_url'] = opts.publicUrl || '/';
data['is_light'] = isLight;
data['key_query_part'] =
req.query.key ? `key=${req.query.key}&` : '';
data['key_query'] = req.query.key ? `?key=${req.query.key}` : '';
req.query.key ? `key=${encodeURIComponent(req.query.key)}&` : '';
data['key_query'] = req.query.key ? `?key=${encodeURIComponent(req.query.key)}` : '';
if (template === 'wmts') res.set('Content-Type', 'text/xml');
return res.status(200).send(compiled(data));
});

2
src/utils.js
View File

@ -40,7 +40,7 @@ module.exports.getTileUrls = (req, domains, path, format, publicUrl, aliases) =>
const key = req.query.key;
const queryParams = [];
if (req.query.key) {
queryParams.push(`key=${req.query.key}`);
queryParams.push(`key=${encodeURIComponent(req.query.key)}`);
}
if (req.query.style) {
queryParams.push(`style=${req.query.style}`);