Skip to content

Commit

Permalink
[Coordinate map] Sanitize WMS attribution (elastic#52309)
Browse files Browse the repository at this point in the history
Sanitize the WMS-attribution input before displaying it in the leaflet-attribution control.
  • Loading branch information
thomasneirynck authored and timductive committed Dec 16, 2019
1 parent 0c2f114 commit 6d2b86d
Show file tree
Hide file tree
Showing 2 changed files with 25 additions and 1 deletion.
24 changes: 23 additions & 1 deletion src/legacy/ui/public/vis/__tests__/map/kibana_map.js
Original file line number Diff line number Diff line change
Expand Up @@ -251,7 +251,6 @@ describe('kibana_map tests', function () {
kibanaMap.removeLayer(layer);
expect(domNode.querySelectorAll('.leaflet-control-attribution')[0].innerHTML).to.equal('foo, bar');


});

});
Expand Down Expand Up @@ -320,6 +319,29 @@ describe('kibana_map tests', function () {

});

it('WMS - should clean attribution', async function () {

const options = {
url: 'https://basemap.nationalmap.gov/arcgis/services/USGSTopo/MapServer/WMSServer',
version: '1.1.0',
layers: '0',
format: 'image/png',
transparent: true,
attribution: '<div>foobar</div>',
styles: '',
minZoom: 1,
maxZoom: 18
};

kibanaMap.setBaseLayer({
baseLayerType: 'wms',
options: options
});

expect(domNode.querySelectorAll('.leaflet-control-attribution')[0].innerHTML).to.equal('&lt;div&gt;foobar&lt;/div&gt;');

});

});


Expand Down
2 changes: 2 additions & 0 deletions src/legacy/ui/public/vis/map/kibana_map.js
Original file line number Diff line number Diff line change
Expand Up @@ -564,6 +564,8 @@ export class KibanaMap extends EventEmitter {

let baseLayer;
if (settings.baseLayerType === 'wms') {
//This is user-input that is rendered with the Leaflet attribution control. Needs to be sanitized.
this._baseLayerSettings.options.attribution = _.escape(settings.options.attribution);
baseLayer = this._getWMSBaseLayer(settings.options);
} else if (settings.baseLayerType === 'tms') {
baseLayer = this._getTMSBaseLayer((settings.options));
Expand Down

0 comments on commit 6d2b86d

Please sign in to comment.