[GEOS-11719] MapML custom projections blocked by content security policy

GeoCat · Feb 17, 2025 · c1599a3 · c1599a3
1 parent 6435345
commit c1599a3
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 18 deletions.
diff --git a/src/extension/mapml/src/main/java/org/geoserver/mapml/MapMLHTMLOutput.java b/src/extension/mapml/src/main/java/org/geoserver/mapml/MapMLHTMLOutput.java
@@ -112,7 +112,7 @@ public String toHTML() {
                 .append("</title>\n")
                 .append("<meta charset='utf-8'>\n")
                 .append("<script type=\"module\"  src=\"")
-                .append(buildViewerPath(request))
+                .append(buildViewerPath(request, "viewer/widget/mapml.js"))
                 .append("\"></script>\n")
                 .append("<style>\n")
                 .append("html, body { height: 100%; }\n")
@@ -148,21 +148,25 @@ public String toHTML() {
                 .append("src=\"")
                 .append(sourceUrL)
                 .append("\" checked></map-layer>\n")
-                .append("</mapml-viewer>\n")
-                .append("</body>\n")
-                .append("</html>");
+                .append("</mapml-viewer>\n");
+        appendProjectionText(projType, sb);
+        sb.append("</body>\n").append("</html>");
         return sb.toString();
     }
 
     private void appendProjectionScript(MapMLProjection projType, StringBuilder sb) {
         if (!projType.isBuiltIn()) {
-            sb.append("<script type=\"module\">\n")
-                    .append("let customProjectionDefinition = `\n")
-                    .append(buildDefinition(projType.getTiledCRS(), 10))
-                    .append("let map = document.querySelector(\"mapml-viewer\");\n")
-                    .append("let cProjection = map.defineCustomProjection(customProjectionDefinition);\n")
-                    .append("map.projection = cProjection;\n")
-                    .append("</script>");
+            sb.append("<script type=\"module\" src=\"")
+                    .append(buildViewerPath(request, "js/custom-projection.js"))
+                    .append("\"></script>\n");
+        }
+    }
+
+    private void appendProjectionText(MapMLProjection projType, StringBuilder sb) {
+        if (!projType.isBuiltIn()) {
+            sb.append("<textarea id=\"customProjection\" style=\"display: none;\">\n")
+                    .append(escapeHtml4(buildDefinition(projType.getTiledCRS(), 10)))
+                    .append("</textarea>");
         }
     }
 
@@ -220,13 +224,13 @@ private String buildDefinition(TiledCRS tiledCRS, int indentChars) {
                 .append("\"proj4string\" : \"")
                 .append(projString)
                 .append("\"\n")
-                .append("}`;\n");
+                .append("}\n");
         return sb.toString();
     }
 
-    private String buildViewerPath(HttpServletRequest request) {
+    private String buildViewerPath(HttpServletRequest request, String path) {
         String base = ResponseUtils.baseURL(request);
-        return ResponseUtils.buildURL(base, "/mapml/viewer/widget/mapml.js", null, URLMangler.URLType.RESOURCE);
+        return ResponseUtils.buildURL(base, "/mapml/" + path, null, URLMangler.URLType.RESOURCE);
     }
 
     private int computeZoom(MapMLProjection projType, ReferencedEnvelope projectedBbox) {

diff --git a/src/extension/mapml/src/main/resources/org/geoserver/mapml/custom-projection.js b/src/extension/mapml/src/main/resources/org/geoserver/mapml/custom-projection.js
@@ -0,0 +1,6 @@
+
+addEventListener("load", () => {
+    let customProjectionDefinition = document.getElementById("customProjection").value;
+    let map = document.querySelector("mapml-viewer");
+    map.projection = map.defineCustomProjection(customProjectionDefinition);
+});
diff --git a/src/extension/mapml/src/test/java/org/geoserver/mapml/tcrs/CustomTiledCRSTest.java b/src/extension/mapml/src/test/java/org/geoserver/mapml/tcrs/CustomTiledCRSTest.java
@@ -362,11 +362,11 @@ public void testTiledCRSOutputHTMLContainsProjectionDefinition() throws Exceptio
 
         Element nextScript = webmapimport.nextElementSibling().nextElementSibling();
         assertNotNull(nextScript);
-        String scriptContent = nextScript.html();
+        assertTrue(
+                "HTML document script must use custom-projection.js module",
+                nextScript.attr("src").matches(".*custom-projection\\.js"));
 
-        assertTrue(scriptContent.contains("customProjectionDefinition"));
-        assertTrue(scriptContent.contains("let map = document.querySelector(\"mapml-viewer\");"));
-        assertTrue(scriptContent.contains("map.defineCustomProjection(customProjectionDefinition"));
+        String scriptContent = doc.getElementById("customProjection").val();
         // Check the customProjectionDefinition exist
         String projectionPattern = "\"projection\":\\s*\"([^\"]+)\"";
         String resolutionsPattern = "\"resolutions\":\\s*\\[[^]]+\\]";