CVE-2024-1163 (published 2024-02-13T15:15Z)

Uncontrolled Resource Consumption in GitHub repository mbloch/mapshaper prior to 0.6.44.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mbloch/mapshaper
commit_details: repo_url: https://github.com/mbloch/mapshaper
author: Matthew Bloch
author_date: 2023-10-03 17:12:47-04:00
msg: v0.6.44
repository: repo_url: https://github.com/mbloch/mapshaper
repo_name: mbloch/mapshaper
description: Tools for editing Shapefile, GeoJSON, TopoJSON and CSV files
repo_language: JavaScript
owner: mbloch
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+v0.6.44
+* Added -style css= option for adding inline CSS to SVG symbols.
+* Bug fixes
+
 v0.6.43
 * Bug fixes
 

programming_language: Markdown
filename: REFERENCE.md
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 # COMMAND REFERENCE
 
-This documentation applies to version 0.6.39 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
+This documentation applies to version 0.6.43 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
 
 ## Command line syntax
 
@@ -1213,6 +1213,8 @@ Add common SVG attributes for SVG export and display in the web UI. Attribute va
 
 `class=`           One or more CSS classes, separated by spaces (e.g. `class="light semi-transparent"`)
 
+`css=`             Inline CSS to use as the `style=` attribute of each SVG symbol.
+
 `fill=`            Fill color (e.g. `#eee` `pink` `rgba(0, 0, 0, 0.2)`)
 
 `fill-pattern=`    Definition string for a pattern. There are four pattern types: hatches, dots, squares and dashes. The syntax for each pattern is:

programming_language: Markdown
filename: mapshaper-gui
change_type: ModificationType.MODIFY
diff: @@ -61,7 +61,10 @@ function startServer(port) {
   http.createServer(function(request, response) {
     var uri = url.parse(request.url).pathname;
     clearTimeout(timeout);
-    if (uri == '/close') {
+    if (uri.includes('..')) {
+      // block attempts to load files outside webroot
+      serve404(response);
+    } else if (uri == '/close') {
       // end process when page closes, unless page is immediately refreshed
       timeout = setTimeout(function() {
         process.exit(0);
@@ -116,10 +119,14 @@ function serveError(text, code, response) {
   response.end();
 }
 
+function serve404(response) {
+  serveError("404 Not Found\n", 404, response);
+}
+
 function serveFile(filename, response) {
   fs.readFile(filename, function(err, content) {
     if (err) {
-      serveError("404 Not Found\n", 404, response);
+      serve404(response);
     } else {
       serveContent(content, response, getMimeType(filename));
     }

programming_language: JavaScript
filename: package-lock.json
change_type: ModificationType.MODIFY
diff: @@ -1,12 +1,12 @@
 {
   "name": "mapshaper",
-  "version": "0.6.43",
+  "version": "0.6.44",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "mapshaper",
-      "version": "0.6.43",
+      "version": "0.6.44",
       "license": "MPL-2.0",
       "dependencies": {
         "@placemarkio/tokml": "^0.3.3",

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "mapshaper",
-  "version": "0.6.43",
+  "version": "0.6.44",
   "description": "A tool for editing vector datasets for mapping and GIS.",
   "keywords": [
     "shapefile",

programming_language: CoffeeScript