Fit GitHub vulnerability

pages/10_🌍_Earth_Engine_Datasets.py

@@ -1,4 +1,5 @@
 import ee
+import json
 import streamlit as st
 import geemap.foliumap as geemap
 
@@ -79,8 +80,7 @@ def search_data():
 
     dataset = None
     with col2:
-        keyword = st.text_input(
-            "Enter a keyword to search (e.g., elevation)", "")
+        keyword = st.text_input("Enter a keyword to search (e.g., elevation)", "")
         if keyword:
             ee_assets = geemap.search_ee_data(keyword)
             asset_titles = [x["title"] for x in ee_assets]
@@ -102,8 +102,7 @@ def search_data():
                 with st.expander("Show dataset details", True):
                     index = asset_titles.index(dataset)
 
-                    html = geemap.ee_data_html(
-                        st.session_state["ee_assets"][index])
+                    html = geemap.ee_data_html(st.session_state["ee_assets"][index])
                     html = html.replace("\n", "")
                     st.markdown(html, True)
 
@@ -111,6 +110,14 @@ def search_data():
                 uid = ee_assets[index]["uid"]
                 st.markdown(f"""**Earth Engine Snippet:** `{ee_id}`""")
                 ee_asset = f"{translate[asset_types[index]]}{ee_id}')"
+
+                if ee_asset.startswith("ee.ImageCollection"):
+                    ee_asset = ee.ImageCollection(ee_id)
+                elif ee_asset.startswith("ee.Image"):
+                    ee_asset = ee.Image(ee_id)
+                elif ee_asset.startswith("ee.FeatureCollection"):
+                    ee_asset = ee.FeatureCollection(ee_id)
+
                 vis_params = st.text_input(
                     "Enter visualization parameters as a dictionary", {}
                 )
@@ -122,12 +129,11 @@ def search_data():
                         if vis_params.strip() == "":
                             # st.error("Please enter visualization parameters")
                             vis_params = "{}"
-                        vis = eval(vis_params)
+                        vis = json.loads(vis_params.replace("'", '"'))
                         if not isinstance(vis, dict):
-                            st.error(
-                                "Visualization parameters must be a dictionary")
+                            st.error("Visualization parameters must be a dictionary")
                         try:
-                            Map.addLayer(eval(ee_asset), vis, layer_name)
+                            Map.addLayer(ee_asset, vis, layer_name)
                         except Exception as e:
                             st.error(f"Error adding layer: {e}")
                     except Exception as e:
@@ -143,8 +149,7 @@ def search_data():
 def app():
     st.title("Earth Engine Data Catalog")
 
-    apps = ["Search Earth Engine Data Catalog",
-            "National Land Cover Database (NLCD)"]
+    apps = ["Search Earth Engine Data Catalog", "National Land Cover Database (NLCD)"]
 
     selected_app = st.selectbox("Select an app", apps)
 

pages/13_🏘️_Global_Building_Footprints.py

@@ -6,7 +6,6 @@ import streamlit as st
 st.set_page_config(layout="wide")
 
 
-@st.cache(persist=True)
 def ee_authenticate(token_name="EARTHENGINE_TOKEN"):
     geemap.ee_initialize(token_name=token_name)
 

pages/1_📷_Timelapse.py

@@ -1,4 +1,5 @@
 import ee
+import json
 import os
 import warnings
 import datetime
@@ -235,8 +236,8 @@ def app():
 
     st.markdown(
         """
-        An interactive web app for creating [Landsat](https://developers.google.com/earth-engine/datasets/catalog/landsat)/[GOES](https://jstnbraaten.medium.com/goes-in-earth-engine-53fbc8783c16) timelapse for any location around the globe. 
-        The app was built using [streamlit](https://streamlit.io), [geemap](https://geemap.org), and [Google Earth Engine](https://earthengine.google.com). For more info, check out my streamlit [blog post](https://blog.streamlit.io/creating-satellite-timelapse-with-streamlit-and-earth-engine). 
+        An interactive web app for creating [Landsat](https://developers.google.com/earth-engine/datasets/catalog/landsat)/[GOES](https://jstnbraaten.medium.com/goes-in-earth-engine-53fbc8783c16) timelapse for any location around the globe.
+        The app was built using [streamlit](https://streamlit.io), [geemap](https://geemap.org), and [Google Earth Engine](https://earthengine.google.com). For more info, check out my streamlit [blog post](https://blog.streamlit.io/creating-satellite-timelapse-with-streamlit-and-earth-engine).
     """
     )
 
@@ -376,7 +377,9 @@ def app():
                         st.write(
                             cm.plot_colormap(cmap=palette_options, return_fig=True)
                         )
-                        st.session_state["palette"] = eval(palette)
+                        st.session_state["palette"] = json.loads(
+                            palette.replace("'", '"')
+                        )
 
                     if bands:
                         vis_params = st.text_area(
@@ -391,7 +394,9 @@ def app():
                             "{}",
                         )
                     try:
-                        st.session_state["vis_params"] = eval(vis_params)
+                        st.session_state["vis_params"] = json.loads(
+                            vis_params.replace("'", '"')
+                        )
                         st.session_state["vis_params"]["palette"] = st.session_state[
                             "palette"
                         ]
@@ -431,7 +436,7 @@ def app():
                 palette_values,
             )
             st.write(cm.plot_colormap(cmap=palette_options, return_fig=True))
-            st.session_state["palette"] = eval(palette)
+            st.session_state["palette"] = json.loads(palette.replace("'", '"'))
         elif collection == "MODIS Ocean Color SMI":
             with st.expander("Show dataset details", False):
                 st.markdown(
@@ -489,7 +494,7 @@ def app():
                 palette_values,
             )
             st.write(cm.plot_colormap(cmap=palette_options, return_fig=True))
-            st.session_state["palette"] = eval(palette)
+            st.session_state["palette"] = json.loads(palette.replace("'", '"'))
 
         sample_roi = st.selectbox(
             "Select a sample ROI or upload a GeoJSON file:",
@@ -1341,7 +1346,9 @@ def app():
                                 if vis_params.startswith("{") and vis_params.endswith(
                                     "}"
                                 ):
-                                    vis_params = eval(vis_params)
+                                    vis_params = json.loads(
+                                        vis_params.replace("'", '"')
+                                    )
                                 else:
                                     vis_params = None
                                 out_gif = geemap.modis_ocean_color_timelapse(

pages/2_🏠_U.S._Housing.py

@@ -224,7 +224,7 @@ def app():
     st.title("U.S. Real Estate Data and Market Trends")
     st.markdown(
         """**Introduction:** This interactive dashboard is designed for visualizing U.S. real estate data and market trends at multiple levels (i.e., national,
-         state, county, and metro). The data sources include [Real Estate Data](https://www.realtor.com/research/data) from realtor.com and 
+         state, county, and metro). The data sources include [Real Estate Data](https://www.realtor.com/research/data) from realtor.com and
          [Cartographic Boundary Files](https://www.census.gov/geographies/mapping-files/time-series/geo/carto-boundary-file.html) from U.S. Census Bureau.
          Several open-source packages are used to process the data and generate the visualizations, e.g., [streamlit](https://streamlit.io),
           [geopandas](https://geopandas.org), [leafmap](https://leafmap.org), and [pydeck](https://deckgl.readthedocs.io).

pages/3_🪟_Split_Map.py

@@ -23,8 +23,8 @@ with st.expander("See source code"):
     with st.echo():
         m = leafmap.Map()
         m.split_map(
-            left_layer='ESA WorldCover 2020 S2 FCC', right_layer='ESA WorldCover 2020'
+            left_layer="ESA WorldCover 2020 S2 FCC", right_layer="ESA WorldCover 2020"
         )
-        m.add_legend(title='ESA Land Cover', builtin_legend='ESA_WorldCover')
+        m.add_legend(title="ESA Land Cover", builtin_legend="ESA_WorldCover")
 
 m.to_streamlit(height=700)

pages/5_📍_Marker_Cluster.py

@@ -23,16 +23,16 @@ with st.expander("See source code"):
     with st.echo():
 
         m = leafmap.Map(center=[40, -100], zoom=4)
-        cities = 'https://raw.githubusercontent.com/giswqs/leafmap/master/examples/data/us_cities.csv'
-        regions = 'https://raw.githubusercontent.com/giswqs/leafmap/master/examples/data/us_regions.geojson'
+        cities = "https://raw.githubusercontent.com/giswqs/leafmap/master/examples/data/us_cities.csv"
+        regions = "https://raw.githubusercontent.com/giswqs/leafmap/master/examples/data/us_regions.geojson"
 
-        m.add_geojson(regions, layer_name='US Regions')
+        m.add_geojson(regions, layer_name="US Regions")
         m.add_points_from_xy(
             cities,
             x="longitude",
             y="latitude",
-            color_column='region',
-            icon_names=['gear', 'map', 'leaf', 'globe'],
+            color_column="region",
+            icon_names=["gear", "map", "leaf", "globe"],
             spin=True,
             add_legend=True,
         )

pages/6_🗺️_Basemaps.py

@@ -22,7 +22,7 @@ def app():
     st.title("Search Basemaps")
     st.markdown(
         """
-    This app is a demonstration of searching and loading basemaps from [xyzservices](https://github.com/geopandas/xyzservices) and [Quick Map Services (QMS)](https://github.com/nextgis/quickmapservices). Selecting from 1000+ basemaps with a few clicks.  
+    This app is a demonstration of searching and loading basemaps from [xyzservices](https://github.com/geopandas/xyzservices) and [Quick Map Services (QMS)](https://github.com/nextgis/quickmapservices). Selecting from 1000+ basemaps with a few clicks.
     """
     )
 
@@ -54,11 +54,7 @@ def app():
 
             if tiles is not None:
                 for tile in tiles:
-                    try:
-                        m.add_xyz_service(tile)
-                    except Exception as e:
-                        with row1_col2:
-                            st.error(e)
+                    m.add_xyz_service(tile)
 
             m.to_streamlit(height=height)
 

pages/7_📦_Web_Map_Service.py

@@ -1,4 +1,5 @@
 import ast
+import json
 import streamlit as st
 import leafmap.foliumap as leafmap
 
@@ -18,6 +19,12 @@ st.sidebar.info(
     """
 )
 
+# Define a whitelist of trusted URLs
+trusted_urls = [
+    "https://services.terrascope.be/wms/v2",
+    # Add more trusted URLs here
+]
+
 
 @st.cache_data
 def get_layers(url):
@@ -25,12 +32,16 @@ def get_layers(url):
     return options
 
 
+def is_trusted_url(url):
+    return url in trusted_urls
+
+
 def app():
     st.title("Web Map Service (WMS)")
     st.markdown(
         """
-    This app is a demonstration of loading Web Map Service (WMS) layers. Simply enter the URL of the WMS service 
-    in the text box below and press Enter to retrieve the layers. Go to https://apps.nationalmap.gov/services to find 
+    This app is a demonstration of loading Web Map Service (WMS) layers. Simply enter the URL of the WMS service
+    in the text box below and press Enter to retrieve the layers. Go to https://apps.nationalmap.gov/services to find
     some WMS URLs if needed.
     """
     )
@@ -49,7 +60,14 @@ def app():
         empty = st.empty()
 
         if url:
-            options = get_layers(url)
+
+            if is_trusted_url(url):
+                options = get_layers(url)
+                # Process options as needed
+            else:
+                st.error(
+                    "The entered URL is not trusted. Please enter a valid WMS URL."
+                )
 
             default = None
             if url == esa_landcover:
@@ -78,7 +96,7 @@ def app():
                         url, layers=layer, name=layer, attribution=" ", transparent=True
                     )
             if add_legend and legend_text:
-                legend_dict = ast.literal_eval(legend_text)
+                legend_dict = json.loads(legend_text.replace("'", '"'))
                 m.add_legend(legend_dict=legend_dict)
 
             m.to_streamlit(height=height)

pages/8_🏜️_Raster_Data_Visualization.py

@@ -1,3 +1,4 @@
+import json
 import os
 import leafmap.foliumap as leafmap
 import leafmap.colormaps as cm
@@ -44,6 +45,14 @@ An interactive web app for visualizing local raster datasets and Cloud Optimized
 """
 )
 
+
+def is_trusted_url(url):
+    if url.startswith("https://opendata.digitalglobe.com/events/california-fire-2020/"):
+        return True
+    else:
+        return False
+
+
 row1_col1, row1_col2 = st.columns([2, 1])
 
 with row1_col1:
@@ -58,7 +67,7 @@ with row1_col2:
         cog,
     )
 
-    if url:
+    if is_trusted_url(url):
         try:
             options = leafmap.cog_bands(url)
         except Exception as e:
@@ -73,6 +82,8 @@ with row1_col2:
             pass
         else:
             st.error("Please select one or three bands")
+    else:
+        st.error("Please enter a trusted URL")
 
     add_params = st.checkbox("Add visualization parameters")
     if add_params:
@@ -82,7 +93,7 @@ with row1_col2:
 
     if len(vis_params) > 0:
         try:
-            vis_params = eval(vis_params)
+            vis_params = json.loads(vis_params.replace("'", '"'))
         except Exception as e:
             st.error(
                 f"Invalid visualization parameters. It should be a dictionary. Error: {e}"

pages/9_🔲_Vector_Data_Visualization.py

@@ -20,6 +20,17 @@ st.sidebar.info(
 )
 
 
+# Define a whitelist of trusted URLs
+trusted_urls = [
+    "https://github.com/giswqs/streamlit-geospatial/raw/master/data/us_states.geojson",
+    # Add more trusted URLs here
+]
+
+
+def is_trusted_url(url):
+    return url in trusted_urls
+
+
 def save_uploaded_file(file_content, file_name):
     """
     Save the uploaded file to a temporary directory
@@ -70,7 +81,7 @@ def app():
 
         container = st.container()
 
-        if data or url:
+        if data or is_trusted_url(url):
             if data:
                 file_path = save_uploaded_file(data, data.name)
                 layer_name = os.path.splitext(data.name)[0]