Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add more sources for markers #45

Merged
merged 5 commits into from
May 22, 2022

Conversation

tiagomartines11
Copy link
Contributor

Addresses #43 with a few more ways to override sources for markers

src/_js/map.js Outdated
Comment on lines 203 to 220
const urlParams = new URLSearchParams(window.location.search);
// Possible markers sources
// A) https://example.com?m=<base64-json-str>#32368,32198,7:0
// B) https://example.com?mf=https://example.com/pack.json#32368,32198,7:0
// C) <div id="map" data-marker-json="<json-str>" ...>
// D) <div id="map" data-marker-pack="https://example.com/pack.json" ...>
// E) fallback: https://tibiamaps.github.io/tibia-map-data/markers.json
if (urlParams.get('m')) {
buildMarkerLayers(atob(JSON.parse(urlParams.get('m'))));
} else if (urlParams.get('mf')) {
loadMarkersPack(urlParams.get('mf'));
} else if (mapContainer.dataset.markerJson) {
buildMarkerLayers(JSON.parse(mapContainer.dataset.markerJson));
} else if (mapContainer.dataset.markerPack) {
loadMarkersPack(URL_PREFIX + mapContainer.dataset.markerPack);
} else {
loadMarkersPack(URL_PREFIX + 'markers.json');
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would be nice to extract this logic to a separate function (called getMarkerPackUrl or some such) that returns a URL to load, so we could have early returns instead of all the else ifs.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this could be much cleaner given the hierarchy I proposed (A behavior overrides B, B overrides C, etc.), but I gave it a try on my latest changes. Lemme know if it looks better. We can also consider other hierarchy or removing some of the sources.

src/_js/map.js Outdated Show resolved Hide resolved
src/_js/map.js Outdated Show resolved Hide resolved
src/_js/map.js Outdated Show resolved Hide resolved
@mathiasbynens
Copy link
Member

The marker data is now user-controlled (either by loading a third-party URL or embedding the data in the URL itself), so we have to be careful not to introduce XSS.

@tiagomartines11
Copy link
Contributor Author

tiagomartines11 commented May 22, 2022

The marker data is now user-controlled (either by loading a third-party URL or embedding the data in the URL itself), so we have to be careful not to introduce XSS.

Do you have any suggestions in mind? Given that user input in being sent to JSON.parse and xhr.open, any XSS attempts would would fail relatively fast, but I might be wrong 🤔

@mathiasbynens
Copy link
Member

The marker data is now user-controlled (either by loading a third-party URL or embedding the data in the URL itself), so we have to be careful not to introduce XSS.

Do you have any suggestions in mind? Given that user input in being sent to JSON.parse and xhr.open, any XSS attempts would would fail relatively fast, but I might be wrong 🤔

It's not JSON.parse and xhr.open I'm worried about, it's what happens after :) I think the current code is safe but I'm not 100% sure how Leaflet handles everything. E.g. a marker with a malicious description a la <img/onload=alert(1)> wouldn't do anything bad right now because we only set the .title property.

src/_js/map.js Outdated Show resolved Hide resolved
@mathiasbynens mathiasbynens merged commit 0c12dfe into tibiamaps:main May 22, 2022
@tiagomartines11 tiagomartines11 deleted the markers-sources branch May 22, 2022 15:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants