Skip to content

Clusters now prevent zoom for same location items #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lmkevinford wants to merge 1 commit into
base: main
Choose a base branch
from
+50 −16
Open

Clusters now prevent zoom for same location items #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 25 additions & 8 deletions src/Better_Map_Widget-Full.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,10 +65,14 @@
registry.pendingDefaults = registry.pendingDefaults || [];
var defaults = {};

defaults.version = "3.70";
defaults.version = "3.71";
defaults.releaseNotes = `
<h2>Release Notes</h2>
<p>Latest releases can be found at <a href="https://github.com/logicmonitor/custom_widgets" target="_blank">https://github.com/logicmonitor/custom_widgets</a></p>
<h3>Version 3.71</h3>
<ul>
<li>If all items in a cluster are at the same location then the cluster's popup now displays a message to that fact explaining why the cluster cannot be zoomed in.</li>
</ul>
<h3>Version 3.70</h3>
<ul>
<li>The loading indicator now shows geocoding progress (&quot;Geocoding x of y&quot;) when addresses are being resolved, so you can see the map is still working when many new locations need coordinates.</li>
Expand Down Expand Up @@ -1225,10 +1229,15 @@
transition: background 0.2s;
}

.cluster-zoom-btn:hover {
.cluster-zoom-btn:hover:not(:disabled) {
background: #1557b0;
}

.cluster-zoom-btn:disabled {
background: #9aa0a6;
cursor: default;
}

.cluster-stats {
display: grid;
gap: 8px;
Expand Down Expand Up @@ -2377,7 +2386,7 @@

// 4. Make the API call
// console.debug(`Executing fetch to: ${apiUrl}`);
const response = await fetch(apiUrl, requestOptions);

Check warning on line 2389 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

URL Redirection to Untrusted Site ('Open Redirect') 

Filename: src/Better_Map_Widget-Full.html
Line: 2389
CWE: 601 (URL Redirection to Untrusted Site ('Open Redirect'))

This call to fetch() contains a URL redirection to untrusted site flaw.  Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials.
Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. 
References: <a href="https://cwe.mitre.org/data/definitions/601.html">CWE</a> <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">OWASP Unvalidated Redirects and Forwards Cheat Sheet</a>
// console.debug(`Received response status: ${response.status} ${response.statusText}`);

// 5. Process the response
Expand Down Expand Up @@ -2410,7 +2419,7 @@
try {
const errorBody = await response.text(); // Use text first in case it's not JSON
error.body = errorBody || 'No additional error details provided.'; // Attach body to error
console.warn(`Map ${widgetID}: API Error Body: ${error.body}`); // Log the raw error body

Check warning on line 2422 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Output Neutralization for Logs 

Filename: src/Better_Map_Widget-Full.html
Line: 2422
CWE: 117 (Improper Output Neutralization for Logs)

This call to console.warn() could result in a log forging attack.  Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files.  Corrupted log files can be used to cover an attacker's tracks or as a delivery mechanism for an attack on a log viewing or processing utility.  For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. 
Avoid directly embedding user input in log files when possible.  Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data.  Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences.  Only create a custom blocklist when absolutely necessary.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/117.html">CWE</a> <a href="https://owasp.org/www-community/attacks/Log_Injection">OWASP Log Injection</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
} catch (bodyError) {
console.warn(`Map ${widgetID}: Could not read error response body:`, bodyError);
error.body = 'Could not read error response body.';
Expand Down Expand Up @@ -4453,13 +4462,13 @@
// was, and the loop would reissue the same request forever against the LM API...
const page = Array.isArray(data.items) ? data.items : [];
if (!page.length) {
console.warn(`Map ${widgetID}: ${label} stopped at ${offset} of ${total} after an empty page.`);

Check warning on line 4465 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Output Neutralization for Logs 

Filename: src/Better_Map_Widget-Full.html
Line: 4465
CWE: 117 (Improper Output Neutralization for Logs)

This call to console.warn() could result in a log forging attack.  Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files.  Corrupted log files can be used to cover an attacker's tracks or as a delivery mechanism for an attack on a log viewing or processing utility.  For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. 
Avoid directly embedding user input in log files when possible.  Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data.  Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences.  Only create a custom blocklist when absolutely necessary.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/117.html">CWE</a> <a href="https://owasp.org/www-community/attacks/Log_Injection">OWASP Log Injection</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
break;
}
items.push(...page);
offset = items.length;

_dom.refreshStatusArea.innerHTML = `${loadingSpinner}&nbsp;${label}: ${offset} of ${total} (${Math.round(offset / total * 100)}%)`;

Check warning on line 4471 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget-Full.html
Line: 4471
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to innerHTML() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
}

return { items, total };
Expand Down Expand Up @@ -5004,7 +5013,7 @@
}
groupDescription = escapeHtml(groupDescription);

content.innerHTML = `

Check warning on line 5016 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget-Full.html
Line: 5016
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to innerHTML() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
<div class="icon ${highestSeverity}">
${sevIcon}
</div>
Expand Down Expand Up @@ -5039,7 +5048,7 @@
groupDescription = "Host:" + escapeHtml(thisItem.name) + "<br/>Address: " + escapeHtml(cachedAddresses[groupID].address);
}

content.innerHTML = `

Check warning on line 5051 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget-Full.html
Line: 5051
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to innerHTML() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
<div class="icon ${highestSeverity}">
${sevIcon}
</div>
Expand Down Expand Up @@ -5451,7 +5460,7 @@
<span class="sidebar-item-content"><span class="sidebar-item-name">${itemName}</span>${propsHtml}</span>
</div>`;
});
sidebar.innerHTML = html;

Check warning on line 5463 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget-Full.html
Line: 5463
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to innerHTML() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
}

// Function to check whether the sidebar is currently expanded...
Expand Down Expand Up @@ -5662,18 +5671,26 @@
clusterBounds.extend(device.position);
});

return `
<div class="mapInfoPopupWindow">
<div class="cluster-header">
<div class="cluster-title">Cluster Summary</div>
<button class="cluster-zoom-btn" data-sw-lat="${clusterBounds.getSouthWest().lat()}" data-sw-lng="${clusterBounds.getSouthWest().lng()}" data-ne-lat="${clusterBounds.getNorthEast().lat()}" data-ne-lng="${clusterBounds.getNorthEast().lng()}">
// When every clustered item sits on the exact same point the bounds collapse to that point,
// so zooming in can never break the cluster apart. Flag it so the popup can disable the zoom
// button and call out why the cluster will not split...
const allSameLocation = clusterBounds.getSouthWest().equals(clusterBounds.getNorthEast());

const zoomBtnInner = allSameLocation ? `All have same location` : `
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="14" height="14">
<circle cx="11" cy="11" r="8"/>
<line x1="21" y1="21" x2="16.65" y2="16.65"/>
<line x1="11" y1="8" x2="11" y2="14"/>
<line x1="8" y1="11" x2="14" y2="11"/>
</svg>
Zoom into Cluster
Zoom into Cluster`;

return `
<div class="mapInfoPopupWindow">
<div class="cluster-header">
<div class="cluster-title">Cluster Summary</div>
<button class="cluster-zoom-btn"${allSameLocation ? ' disabled' : ''} data-sw-lat="${clusterBounds.getSouthWest().lat()}" data-sw-lng="${clusterBounds.getSouthWest().lng()}" data-ne-lat="${clusterBounds.getNorthEast().lat()}" data-ne-lng="${clusterBounds.getNorthEast().lng()}">
${zoomBtnInner}
</button>
</div>
<div class="cluster-stats">
Expand Down Expand Up @@ -5818,12 +5835,12 @@
const url = getTileUrl(coord, zoom);
if (!url) return div;
const img = ownerDocument.createElement('img');
img.src = url;

Check warning on line 5838 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget-Full.html
Line: 5838
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to src() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
img.style.width = '100%';
img.style.height = '100%';
img.style.display = 'block';
img.style.opacity = weatherOpacity;
div.appendChild(img);

Check warning on line 5843 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget-Full.html
Line: 5843
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to Node.appendChild() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
return div;
},
releaseTile(tile) {
Expand Down Expand Up @@ -6744,7 +6761,7 @@
const contMmiUrl = (shakemapProduct && shakemapProduct.contents && shakemapProduct.contents["download/cont_mmi.json"] && shakemapProduct.contents["download/cont_mmi.json"].url);

if (contMmiUrl) {
const contMmiResponse = await fetch(contMmiUrl);

Check warning on line 6764 in src/Better_Map_Widget-Full.html

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

URL Redirection to Untrusted Site ('Open Redirect') 

Filename: src/Better_Map_Widget-Full.html
Line: 6764
CWE: 601 (URL Redirection to Untrusted Site ('Open Redirect'))

This call to fetch() contains a URL redirection to untrusted site flaw.  Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials.
Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. 
References: <a href="https://cwe.mitre.org/data/definitions/601.html">CWE</a> <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">OWASP Unvalidated Redirects and Forwards Cheat Sheet</a>
const contMmiData = await contMmiResponse.json();

// Find max and min MMI values for color scaling...
Expand Down
7 changes: 6 additions & 1 deletion src/Better_Map_Widget.css
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -824,10 +824,15 @@ body {
transition: background 0.2s;
}

.cluster-zoom-btn:hover {
.cluster-zoom-btn:hover:not(:disabled) {
background: #1557b0;
}

.cluster-zoom-btn:disabled {
background: #9aa0a6;
cursor: default;
}

.cluster-stats {
display: grid;
gap: 8px;
Expand Down
26 changes: 19 additions & 7 deletions src/Better_Map_Widget.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,14 @@
// * Use hyphen-minus (-) instead of em/en dashes, straight ' and " for quotes, and ... for ellipsis.

// ------------------------------------------------------------
var version = "3.70 CDN";
var version = "3.71 CDN";
var releaseNotes = `
<h2>Release Notes</h2>
<p>Latest releases can be found at <a href="https://github.com/logicmonitor/custom_widgets" target="_blank">https://github.com/logicmonitor/custom_widgets</a></p>
<h3>Version 3.71</h3>
<ul>
<li>If all items in a cluster are at the same location then the cluster's popup now displays a message to that fact explaining why the cluster cannot be zoomed in.</li>
</ul>
<h3>Version 3.70</h3>
<ul>
<li>The loading indicator now shows geocoding progress (&quot;Geocoding x of y&quot;) when addresses are being resolved, so you can see the map is still working when many new locations need coordinates.</li>
Expand Down Expand Up @@ -563,7 +567,7 @@
root = document.createElement("div");
root.className = "customMapBody";
root.innerHTML = "&nbsp;";
(document.body || document.documentElement).appendChild(root);

Check warning on line 570 in src/Better_Map_Widget.js

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget.js
Line: 570
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to Node.appendChild() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
return root;
}

Expand Down Expand Up @@ -1634,7 +1638,7 @@
try {
const errorBody = await response.text(); // Use text first in case it's not JSON
error.body = errorBody || 'No additional error details provided.'; // Attach body to error
console.warn(`Map ${widgetID}: API Error Body: ${error.body}`); // Log the raw error body

Check warning on line 1641 in src/Better_Map_Widget.js

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Output Neutralization for Logs 

Filename: src/Better_Map_Widget.js
Line: 1641
CWE: 117 (Improper Output Neutralization for Logs)

This call to console.warn() could result in a log forging attack.  Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files.  Corrupted log files can be used to cover an attacker's tracks or as a delivery mechanism for an attack on a log viewing or processing utility.  For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. 
Avoid directly embedding user input in log files when possible.  Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data.  Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences.  Only create a custom blocklist when absolutely necessary.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/117.html">CWE</a> <a href="https://owasp.org/www-community/attacks/Log_Injection">OWASP Log Injection</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
} catch (bodyError) {
console.warn(`Map ${widgetID}: Could not read error response body:`, bodyError);
error.body = 'Could not read error response body.';
Expand Down Expand Up @@ -3487,13 +3491,13 @@
// was, and the loop would reissue the same request forever against the LM API...
const page = Array.isArray(data.items) ? data.items : [];
if (!page.length) {
console.warn(`Map ${widgetID}: ${label} stopped at ${offset} of ${total} after an empty page.`);

Check warning on line 3494 in src/Better_Map_Widget.js

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Output Neutralization for Logs 

Filename: src/Better_Map_Widget.js
Line: 3494
CWE: 117 (Improper Output Neutralization for Logs)

This call to console.warn() could result in a log forging attack.  Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files.  Corrupted log files can be used to cover an attacker's tracks or as a delivery mechanism for an attack on a log viewing or processing utility.  For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. 
Avoid directly embedding user input in log files when possible.  Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data.  Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences.  Only create a custom blocklist when absolutely necessary.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/117.html">CWE</a> <a href="https://owasp.org/www-community/attacks/Log_Injection">OWASP Log Injection</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
break;
}
items.push(...page);
offset = items.length;

_dom.refreshStatusArea.innerHTML = `${loadingSpinner}&nbsp;${label}: ${offset} of ${total} (${Math.round(offset / total * 100)}%)`;

Check warning on line 3500 in src/Better_Map_Widget.js

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget.js
Line: 3500
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to innerHTML() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
}

return { items, total };
Expand Down Expand Up @@ -4039,7 +4043,7 @@
}
groupDescription = escapeHtml(groupDescription);

content.innerHTML = `

Check warning on line 4046 in src/Better_Map_Widget.js

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget.js
Line: 4046
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to innerHTML() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
<div class="icon ${highestSeverity}">
${sevIcon}
</div>
Expand Down Expand Up @@ -4074,7 +4078,7 @@
groupDescription = "Host:" + escapeHtml(thisItem.name) + "<br/>Address: " + escapeHtml(cachedAddresses[groupID].address);
}

content.innerHTML = `

Check warning on line 4081 in src/Better_Map_Widget.js

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget.js
Line: 4081
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to innerHTML() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
<div class="icon ${highestSeverity}">
${sevIcon}
</div>
Expand Down Expand Up @@ -4487,7 +4491,7 @@
<span class="sidebar-item-content"><span class="sidebar-item-name">${itemName}</span>${propsHtml}</span>
</div>`;
});
sidebar.innerHTML = html;

Check warning on line 4494 in src/Better_Map_Widget.js

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget.js
Line: 4494
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to innerHTML() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
}

// Function to check whether the sidebar is currently expanded...
Expand Down Expand Up @@ -4698,18 +4702,26 @@
clusterBounds.extend(device.position);
});

return `
<div class="mapInfoPopupWindow">
<div class="cluster-header">
<div class="cluster-title">Cluster Summary</div>
<button class="cluster-zoom-btn" data-sw-lat="${clusterBounds.getSouthWest().lat()}" data-sw-lng="${clusterBounds.getSouthWest().lng()}" data-ne-lat="${clusterBounds.getNorthEast().lat()}" data-ne-lng="${clusterBounds.getNorthEast().lng()}">
// When every clustered item sits on the exact same point the bounds collapse to that point,
// so zooming in can never break the cluster apart. Flag it so the popup can disable the zoom
// button and call out why the cluster will not split...
const allSameLocation = clusterBounds.getSouthWest().equals(clusterBounds.getNorthEast());

const zoomBtnInner = allSameLocation ? `All have same location` : `
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="14" height="14">
<circle cx="11" cy="11" r="8"/>
<line x1="21" y1="21" x2="16.65" y2="16.65"/>
<line x1="11" y1="8" x2="11" y2="14"/>
<line x1="8" y1="11" x2="14" y2="11"/>
</svg>
Zoom into Cluster
Zoom into Cluster`;

return `
<div class="mapInfoPopupWindow">
<div class="cluster-header">
<div class="cluster-title">Cluster Summary</div>
<button class="cluster-zoom-btn"${allSameLocation ? ' disabled' : ''} data-sw-lat="${clusterBounds.getSouthWest().lat()}" data-sw-lng="${clusterBounds.getSouthWest().lng()}" data-ne-lat="${clusterBounds.getNorthEast().lat()}" data-ne-lng="${clusterBounds.getNorthEast().lng()}">
${zoomBtnInner}
</button>
</div>
<div class="cluster-stats">
Expand Down Expand Up @@ -4872,12 +4884,12 @@
const url = getTileUrl(coord, zoom);
if (!url) return div;
const img = ownerDocument.createElement('img');
img.src = url;

Check warning on line 4887 in src/Better_Map_Widget.js

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget.js
Line: 4887
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to src() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
img.style.width = '100%';
img.style.height = '100%';
img.style.display = 'block';
img.style.opacity = weatherOpacity;
div.appendChild(img);

Check warning on line 4892 in src/Better_Map_Widget.js

View check run for this annotation

Veracode Workflow App / Veracode Static Code Analysis - Pipeline

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 

Filename: src/Better_Map_Widget.js
Line: 4892
CWE: 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

This call to Node.appendChild() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. 
Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">OWASP Cross Site Scripting Prevention Cheat Sheet</a>. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/79.html">CWE</a> <a href="https://owasp.org/www-community/attacks/xss/">OWASP Cross Site Scripting (XSS)</a> <a href="https://docs.veracode.com/r/review_cleansers">Supported Cleansers</a>
return div;
},
releaseTile(tile) {
Expand Down
Loading