CVE-2024-1163: Insufficient Information (NVD-CWE-noinfo)
value: Uncontrolled Resource Consumption in GitHub repository mbloch/mapshaper prior to 0.6.44.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-13T15:15Z
Repository: https://github.com/mbloch/mapshaper
Language: JSON
Files changed: CHANGELOG.md, REFERENCE.md, bin/mapshaper-gui, package-lock.json, package.json
Commit date: 2023-10-03 17:12:47 -0400
Commit message: v0.6.44

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 13d23a84..0f0a6f26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
+v0.6.44
+* Added -style css= option for adding inline CSS to SVG symbols.
+* Bug fixes
+
 v0.6.43
 * Bug fixes
 
 v0.6.42
 * Added "+ add field" button to web ui inspector in attribute editing mode.
diff --git a/REFERENCE.md b/REFERENCE.md
index 51e8a123..2eb4d9d7 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -1,8 +1,8 @@
 # COMMAND REFERENCE
 
-This documentation applies to version 0.6.39 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
+This documentation applies to version 0.6.43 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
 
 ## Command line syntax
 
 Mapshaper takes a list of commands and runs them in sequence, from left to right. A command consists of the name of a command prefixed by a hyphen, followed by options for the command. The initial import command `-i` can be omitted.
 
@@ -1211,10 +1211,12 @@ Add common SVG attributes for SVG export and display in the web UI. Attribute va
 
 `where=`           Boolean JS expression for targetting a subset of features.
 
 `class=`           One or more CSS classes, separated by spaces (e.g. `class="light semi-transparent"`)
 
+`css=`             Inline CSS to use as the `style=` attribute of each SVG symbol.
+
 `fill=`            Fill color (e.g. `#eee` `pink` `rgba(0, 0, 0, 0.2)`)
 
 `fill-pattern=`    Definition string for a pattern. There are four pattern types: hatches, dots, squares and dashes. The syntax for each pattern is:
 
 - hatches [rotation] width1 color1 [width2 color2 ...]
diff --git a/bin/mapshaper-gui b/bin/mapshaper-gui
index 41333c80..1ba2b180 100755
--- a/bin/mapshaper-gui
+++ b/bin/mapshaper-gui
@@ -59,11 +59,14 @@ function startServer(port) {
   var timeout;
 
   http.createServer(function(request, response) {
     var uri = url.parse(request.url).pathname;
     clearTimeout(timeout);
-    if (uri == '/close') {
+    if (uri.includes('..')) {
+      // block attempts to load files outside webroot
+      serve404(response);
+    } else if (uri == '/close') {
       // end process when page closes, unless page is immediately refreshed
       timeout = setTimeout(function() {
         process.exit(0);
       }, 200);
     } else if (uri == "/manifest.js") {
@@ -114,14 +117,18 @@ function serveError(text, code, response) {
   response.writeHead(code, {"Content-Type": "text/plain"});
   response.write(text);
   response.end();
 }
 
+function serve404(response) {
+  serveError("404 Not Found\n", 404, response);
+}
+
 function serveFile(filename, response) {
   fs.readFile(filename, function(err, content) {
     if (err) {
-      serveError("404 Not Found\n", 404, response);
+      serve404(response);
     } else {
       serveContent(content, response, getMimeType(filename));
     }
   });
 }
diff --git a/package-lock.json b/package-lock.json
index a1c2466e..61d74f1d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,14 +1,14 @@
 {
   "name": "mapshaper",
-  "version": "0.6.43",
+  "version": "0.6.44",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "mapshaper",
-      "version": "0.6.43",
+      "version": "0.6.44",
       "license": "MPL-2.0",
       "dependencies": {
         "@placemarkio/tokml": "^0.3.3",
         "@tmcw/togeojson": "^5.6.0",
         "@xmldom/xmldom": "^0.8.6",
diff --git a/package.json b/package.json
index 1fde2460..b3c52e33 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "mapshaper",
-  "version": "0.6.43",
+  "version": "0.6.44",
   "description": "A tool for editing vector datasets for mapping and GIS.",
   "keywords": [
     "shapefile",
     "topojson",
     "geojson",

Vulnerable code: This documentation applies to version 0.6.39 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
    if (uri == '/close') {
      serveError("404 Not Found\n", 404, response);
  "version": "0.6.43",
      "version": "0.6.43",
  "version": "0.6.43",
Fixed code: v0.6.44
* Added -style css= option for adding inline CSS to SVG symbols.
* Bug fixes

This documentation applies to version 0.6.43 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
`css=`             Inline CSS to use as the `style=` attribute of each SVG symbol.

    if (uri.includes('..')) {
      // block attempts to load files outside webroot
      serve404(response);
    } else if (uri == '/close') {
function serve404(response) {
  serveError("404 Not Found\n", 404, response);
}

      serve404(response);
  "version": "0.6.44",
      "version": "0.6.44",
  "version": "0.6.44",