Repository navigation
fix(web): escape loadpoint HTML and ship Leaflet on the box - #910
Merged
Merged
Conversation
Stop interpolating vehicle and planner strings into innerHTML. Load the weather map from /vendor/leaflet so the box does not run script from unpkg.
frahlg
force-pushed
the
agent/web-escape-and-vendor-leaflet
branch
from
August 14, 2026 06:04
f96fbe3 to
03459a3
Compare
HuggeK
added a commit
to HuggeK/ftw
that referenced
this pull request
Aug 29, 2026
…a CDN Upstream ships Leaflet on the box (srcfl#910) for a reason that applies just as hard to its replacement: the box UI must not execute third-party JS from a CDN, and the map must load when the gateway cannot reach the internet. So MapLibre GL JS 6.0.0 moves into web/vendor/maplibre — the ESM entry, its code-split chunk, its worker, the stylesheet and the license — and the loader imports it same-origin, which also spares MapLibre its blob: worker detour. The now-unused vendored Leaflet goes away with its test; maplibre-vendor.test.mjs pins the new contract, including the per-request referrerPolicy opt-in that keeps OSM volunteer tile servers from 403ing under the box's Referrer-Policy: no-referrer. Co-authored-by: HuggeK <48095810+HuggeK@users.noreply.github.com>
This was referenced Aug 29, 2026
HuggeK
added a commit
to HuggeK/ftw
that referenced
this pull request
Sep 2, 2026
…a CDN Upstream ships Leaflet on the box (srcfl#910) for a reason that applies just as hard to its replacement: the box UI must not execute third-party JS from a CDN, and the map must load when the gateway cannot reach the internet. So MapLibre GL JS 6.0.0 moves into web/vendor/maplibre — the ESM entry, its code-split chunk, its worker, the stylesheet and the license — and the loader imports it same-origin, which also spares MapLibre its blob: worker detour. The now-unused vendored Leaflet goes away with its test; maplibre-vendor.test.mjs pins the new contract, including the per-request referrerPolicy opt-in that keeps OSM volunteer tile servers from 403ing under the box's Referrer-Policy: no-referrer. Co-authored-by: HuggeK <48095810+HuggeK@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two holes in the box UI, neither of them LAN login.
XSS.
loadpoints.jswrote vehicle names, planner reasons and loadpoint ids intoinnerHTMLwith no escape. A charger or vehicle name that contains markup would run in the dashboard origin. The heat-pump card already escapes; this panel did not.CDN script. Settings → Weather loaded Leaflet from unpkg. Three.js and Ace are already vendored so the box does not execute third-party JS. Leaflet now lives at
web/vendor/leaflet/(1.9.4) and loads from/vendor/leaflet/.Map tiles still come from OpenStreetMap when someone opens the weather tab. That can leak location. It does not run foreign script.
Test plan
node --test web/loadpoints-xss.test.mjs web/leaflet-vendor.test.mjs web/loadpoint-battery-boost.test.mjs web/javascript-syntax.test.mjsOut of scope