Skip to content

Add more sources for markers#45

Merged
mathiasbynens merged 5 commits into
tibiamaps:mainfrom
tiagomartines11:markers-sources
May 22, 2022
Merged

Add more sources for markers#45
mathiasbynens merged 5 commits into
tibiamaps:mainfrom
tiagomartines11:markers-sources

Conversation

@tiagomartines11
Copy link
Copy Markdown
Contributor

Addresses #43 with a few more ways to override sources for markers

Comment thread src/_js/map.js Outdated
Comment on lines +203 to +220
const urlParams = new URLSearchParams(window.location.search);
// Possible markers sources
// A) https://example.com?m=<base64-json-str>#32368,32198,7:0
// B) https://example.com?mf=https://example.com/pack.json#32368,32198,7:0
// C) <div id="map" data-marker-json="<json-str>" ...>
// D) <div id="map" data-marker-pack="https://example.com/pack.json" ...>
// E) fallback: https://tibiamaps.github.io/tibia-map-data/markers.json
if (urlParams.get('m')) {
buildMarkerLayers(atob(JSON.parse(urlParams.get('m'))));
} else if (urlParams.get('mf')) {
loadMarkersPack(urlParams.get('mf'));
} else if (mapContainer.dataset.markerJson) {
buildMarkerLayers(JSON.parse(mapContainer.dataset.markerJson));
} else if (mapContainer.dataset.markerPack) {
loadMarkersPack(URL_PREFIX + mapContainer.dataset.markerPack);
} else {
loadMarkersPack(URL_PREFIX + 'markers.json');
}
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would be nice to extract this logic to a separate function (called getMarkerPackUrl or some such) that returns a URL to load, so we could have early returns instead of all the else ifs.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this could be much cleaner given the hierarchy I proposed (A behavior overrides B, B overrides C, etc.), but I gave it a try on my latest changes. Lemme know if it looks better. We can also consider other hierarchy or removing some of the sources.

Comment thread src/_js/map.js Outdated
Comment thread src/_js/map.js Outdated
Comment thread src/_js/map.js Outdated
@mathiasbynens
Copy link
Copy Markdown
Member

The marker data is now user-controlled (either by loading a third-party URL or embedding the data in the URL itself), so we have to be careful not to introduce XSS.

@tiagomartines11
Copy link
Copy Markdown
Contributor Author

tiagomartines11 commented May 22, 2022

The marker data is now user-controlled (either by loading a third-party URL or embedding the data in the URL itself), so we have to be careful not to introduce XSS.

Do you have any suggestions in mind? Given that user input in being sent to JSON.parse and xhr.open, any XSS attempts would would fail relatively fast, but I might be wrong 🤔

@mathiasbynens
Copy link
Copy Markdown
Member

The marker data is now user-controlled (either by loading a third-party URL or embedding the data in the URL itself), so we have to be careful not to introduce XSS.

Do you have any suggestions in mind? Given that user input in being sent to JSON.parse and xhr.open, any XSS attempts would would fail relatively fast, but I might be wrong 🤔

It's not JSON.parse and xhr.open I'm worried about, it's what happens after :) I think the current code is safe but I'm not 100% sure how Leaflet handles everything. E.g. a marker with a malicious description a la <img/onload=alert(1)> wouldn't do anything bad right now because we only set the .title property.

Comment thread src/_js/map.js Outdated
@mathiasbynens mathiasbynens merged commit 0c12dfe into tibiamaps:main May 22, 2022
@tiagomartines11 tiagomartines11 deleted the markers-sources branch May 22, 2022 15:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants