Hey @MSantos - we're looking at having an external vendor complete this review. Whether or not that happens, or we perform the review internally, we'll plan to have an update for you within two weeks (2021-04-28).

Thanks @sbassett, that sounds great! I have one question for you, is there still time to squeeze in a plugin that will use this library for RTL text rendering? Should I create another task?

The plugin in question is https://github.com/mapbox/mapbox-gl-rtl-text will need to be forked because it wasn't yet forked by Maplibre but the only dependency is the WebGL renderer described in this ticket.

Here is the reasoning behind the need of this plugin T280040: Solution for right-to-left labels

In T274356#7003853, @MSantos wrote:

Thanks @sbassett, that sounds great! I have one question for you, is there still time to squeeze in a plugin that will use this library for RTL text rendering? Should I create another task?

Yes, let's create a separate task for now, as these reviews will likely need to be performed separately, at separate times. Thanks.

@MSantos - We had one of our vendors (ROS) perform a security audit of mapbox-gl-js. Their findings are as follows:

Vulnerability ID: WKM-003
Vulnerability type:
Input Validation Threat level: low

Description

An XSS vulnerability can be introduced if an attacker can control the contents of a map's style.

Technical description

The contents of a map is displayed by parsing the map's style property. This value can either be a URL to a JSON object or a directly specified JSON object. The XSS vulnerability can be exploited if the style is loaded from an untrusted third party or if the JSON object can be controlled by a malicious user.

var map = new maplibregl.Map({
container: 'map',
style: '<input>'
});

Among other things, the style specification contains information about sources of the map. Depending on the type of source, the field attribution is supported. By specifying this value an attribution text is displayed in the lower right corner of the map. The attribution text is allowed to contain unsanitized HTML, which can be exploited by an attacker to trigger a XSS. The following sample source contains an attribution field with injected JavaScript:

[...]
"sources": {
"maplibre": {
"url": "https://demotiles.maplibre.org/tiles/tiles.json",
"type": "vector",
"attribution":"<img src=x onerror=alert(document.location)>"
}
[...]

Impact

If the map's style is loaded from a URL, the resource owner of that style can exploit a XSS vulnerability.

Recommendation

1. Validate the style object before processing.
2. Do not load a style from an untrusted third party.

Non-findings

It was found that the JavaScript library maplibre-gl-js supports various functionalities that allow rendering HTML into the webpage DOM. If these functionalities are not properly used, this could lead to XSS vulnerabilities. Such a vulnerability can be introduced if unsanitized user input reaches one of the sinks listed below.

Possible XSS via Popup

The Popup component allows inserting HTML into the displayed popup windows with the function setHTML . Therefore, this function should not be used with unsanitized user input.

var popup = new maplibregl.Popup({offset: popupOffsets, className: 'my-class'})
.setLngLat({lng: 10, lat: 10})
.setHTML("\x3cimg src=x onerror=alert(document.location)\x3e")
.setMaxWidth("300px")

Possible XSS via AtrributionControl

MapLibre GL JS supports displaying attribution text in the lower right corner of the map. This attribution text can also contain HTML and should therefore not be used with unsanitized user input.

new maplibregl.AttributionControl({
  compact: true,
  customAttribution:'\x3cimg src=x onerror=alert(document.location)\x3e'
  })

Possible XSS via the locale option

The text of the ScaleControl in the lower left corner of the map can be overwritten using the locale property of the Map component. An XSS vulnerability might be introduced if this property can be controlled by a user.

var map = new maplibregl.Map({
     container: 'map',
     style: '<style_url>',
     center: [0, 0],
     locale: {'ScaleControl.Miles':'\x3cimg src=y onerror=alert(2)\x3e'},
     zoom: 1.28
});

It should be noted that the library is not vulnerable by default. Exploitation of a XSS vulnerability in the above components depends on how the library is used. If user input is handled by these components, it is recommended to sanitize the input before rendering.

Note: since these are all low-risk issues or non-issues, the risk for this library is automatically accepted.

@sbassett thank you so much! I'll create follow-up patches for the recommendations listed here.