geosolutions-it / MapStore2
76%
master: 77%

LAST BUILD BRANCH: 2026.02.xx
DEFAULT BRANCH: master
Repo Added
Files 1729
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH 2026.02.xx
branch: SELECT
CHANGE BRANCH
x

coverage: 75.617% (+0.01%) from 75.607%
29265575821

push

github

web-flow 
Fix #12618: preserve and scope <style> in HTML GetFeatureInfo responses (#12632) (#12639)

* Fix #12618: preserve and scope <style> in HTML GetFeatureInfo responses

DOMPurify parses input as a full document, so the leading <style> block
of a WMS GetFeatureInfo HTML response was hoisted into <head> and then
discarded, leaving the featureInfo table unstyled. Add FORCE_BODY so the
allowlisted <style> element is preserved.

Since this makes the CSS-sanitizing hook load-bearing, harden it against
external-resource loaders in a malicious style block: CSS backslash escapes
smuggling url() past the regex (decoded first, with the full CSS whitespace
terminator set), and image-set() which loads URLs without a url() token.

Render the GetFeatureInfo HTML through a new ShadowHtml component (shadow
root) so the preserved WMS <style> block is scoped to the identify panel
instead of leaking into and restyling the whole application. HTML is still
sanitized with DOMPurify before injection; the shadow root isolates CSS,
it is not a script security boundary.



* Apply suggestions from code review



* Apply suggestion from @offtherailz

* Apply suggestion from @offtherailz

---------


(cherry picked from commit 1fa3ea5a7)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

35718 of 56445 branches covered (63.28%)

17 of 18 new or added lines in 3 files covered. (94.44%)

44492 of 58839 relevant lines covered (75.62%)

122.48 hits per line

Relevant lines Covered
58839 RELEVANT LINES 44492 COVERED LINES
122.48 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
29265575821 2026.02.xx Fix #12618: preserve and scope <style> in HTML GetFeatureInfo responses (#12632) (#12639) * Fix #12618: preserve and scope <style> in HTML GetFeatureInfo responses DOMPurify parses input as a full document, so the leading <style> block of a WMS ... push web-flow github
75.62
29265623079 2026.02.xx Fix #12620 cyclomedia orb issue (#12631) (#12638) * Fix #12620 Cyclomedia images not shown Cyclomedia retired the v23.7 StreetSmart API endpoint hardcoded as default; their server now falls back to serving their own web app shell (HTML) instead ... push web-flow github
75.61
29260802116 2026.02.xx Update OSM base URL in PrintUtils.js (#12633) (#12637) * Update PrintUtils.js * Update PrintUtils.js (cherry picked from commit e08f2536a) Co-authored-by: Tobia Di Pisa <tobia.dipisa@geosolutionsgroup.com> push web-flow github
75.61
29259828304 backport-12631-to-2026.02.xx Merge 9ac563500 into 2ea0b3640 Pull #12638 web-flow github
75.6
29259865643 backport-12633-to-2026.02.xx Merge 3b02e2a04 into 2ea0b3640 Pull #12637 web-flow github
75.6
29258142222 12607-userguide Merge 1ef67471e into 1fa3ea5a7 Pull #12640 web-flow github
75.76
25391489960 C040-2025.02.xx #12330: RULES MANAGER - Add possibility to have an extra list of geoserver urls where cache can be invalidated (#12334) (#12337) * #12330: RULES MANAGER - Add possibility to have an extra list of geoserver urls where cache can be invalidated - in... push web-flow github
76.8
25390105605 update_genova_revision Merge a04bafb02 into b68d238f3 Pull #12337 web-flow github
76.79
25386042205 c027-2025.01.xx #12330: RULES MANAGER - Add possibility to have an extra list of geoserver urls where cache can be invalidated (#12334) (#12335) * #12330: RULES MANAGER - Add possibility to have an extra list of geoserver urls where cache can be invalidated - in... push web-flow github
76.83
25385259696 update_12312_c027 Merge f780f997f into 3322629fc Pull #12335 web-flow github
76.83
See All Builds (17926)