Skip to content

Commit e9cba34

Browse files
tariqksolimanjtrobertsac-61jl-0claude
authored
#699 Update Feature Branch (#747)
* Use PolyMeasure to draw great circle lines with Measure Tool * Round meters to two digits on Measure tool x-axis * Added option to not display PolylineMeasure tooltips * Fix bug with noDataValue for single banded COGs (#700) * Fixed issue where rubberline is not drawn with first click or after zoom * Fix critical security vulnerabilities identified in SonarQube analysis (#701) * Fix critical security vulnerabilities identified in SonarQube analysis This commit addresses 8 legitimate security vulnerabilities while documenting 13 false positives that had adequate existing protections. Security fixes implemented: **Path Injection Vulnerabilities (3 issues fixed):** - middleware.js: Added URL validation requiring /Missions prefix and blocking directory traversal sequences (../ and ..\) - configs.js: Fixed flawed validation logic (AND→OR) and added directory traversal protection for mission names **Cross-Site Scripting (1 issue fixed):** - configs.js: Added sanitizeInput() function to escape HTML entities in error messages containing user-controlled data, preventing reflected XSS attacks **Insecure Temporary File Creation (4 sample fixes):** - Replaced insecure tempfile.mktemp() with tempfile.mkstemp() in: - auxiliary/demtiles/gdal2demtiles.py (lines 839, 874) - auxiliary/gdal2tiles4extent/gdal2tiles4extent.py (line 521) - auxiliary/gdal2customtiles/legacy/gdal2customtiles.py (line 601) - Eliminates race condition vulnerabilities in GDAL processing scripts **False Positives Documented:** - SQL Injection (5 issues): Existing parameterized queries and input sanitization provide adequate protection - Analysis details in reviewed_findings.md All fixes maintain backward compatibility while significantly improving security posture. Remaining auxiliary Python scripts follow the same tempfile pattern for completion. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * Tweaks to critical security vulnerability fixes * Support .. as long as it stays within /Missions --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Tariq Soliman <Tariq.K.Soliman@jpl.nasa.gov> * Minor fix: sort geodataset results * Make sure polyline measurements are cleared on reset * #702 Fix LayersTool filtering on non-dynamicExtent props-on-click geodatasets (#703) * Minor fix: more versatile Help root pathing * #704 Upgrade All Adjacent Servers (#705) * Don't use polyline with LOS or else it results in two lines * Make sure rubberline gets drawn in continuous modes * Ensure line of sight follows great circle and polyline display cleanup * Update Dockerfile to update certs * Use LOS technique to draw great circle lines with varying colors * Show great circle line even if no DEM #52 * #708 User Account Management (#711) * #708 User Account Management 1 * #708 user account control part 2 * #708 user account management part 3 * User account control part 4 * #708 minor style tweaks * Minor resetPassword link fix * Use contours on all login pages * #712 Fix some security issues (#713) * #714 Configurable Wrapping for 2D Map (#715) * #714 Map maxbounds * #714 apply to projected maps too * #716 Per Mission Permissions (#717) * #716 Per-Mission Permission part 1 * #716 Per Mission Permissions * #718 Globe Controls clash with Separated Tool buttons in the UI (#719) * Added multi-platform build to support arm64 architecture * Fix ensureUser for new Admins * Separate platform builds and append -arm64 to the end of arm64 images * Use separate ARM64 runner for faster ARM64 Docker builds * Fix arm64 tag assignment syntax * Use a prerendered image for the layer legend #658 * #721 Show, Delete, and Search for individual STAC items (#723) * #721 STAC item UI part 1 * #721 STAC item UI part 2 * Bump version 4.0.0 -> 4.1.0 * Adjust legend width based on legend image up to 300px * #724 Legends Max on top (#725) * Add feature to set Layer header expanded state individually (#726) * Expand layers feature * Fix bug with keeping header expanded/unexpanded state * Expand individual headers only if LayersTool.vars.expanded is not set to true * #727 STAC item regex search and bulk delete (#728) * #727 Stac item regex, bbox, bulk delete support part 1 * #727 Support 32bit stac items in map * #729 Default configuration for live mode (#730) * #731 Projection Tab Autocomplete, Case Insensitive Mission Sorting, Smart field dsiabling in /configure (#732) * Filter out blank csv entries in csvToJSON function (#734) * Add amd64 image suffix and build it last * Use regular docker build instead of buildx * Add Legend tool display options (#735) * Add configuration options * Add header options for legend tool * Improve syntax * #736 Configure Required Field Indicators (#737) * #738 Fix GeoDataset LOCAL (#739) * #740 Add mission planet radii (#741) * Add legend-based property styling for vector layers * #742 Configure Preview iframe to respect subpaths (#744) * #709 Improved Continuous Legend Symbology Styling * #745 Live Follow Mode (#746) --------- Co-authored-by: Joe Roberts <joe.t.roberts@jpl.nasa.gov> Co-authored-by: ac-61 <ac-61@users.noreply.github.com> Co-authored-by: Jeff Leach <jl-0@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Joe T. Roberts <5315956+jtroberts@users.noreply.github.com>
1 parent 9d2782f commit e9cba34

File tree

113 files changed

+10871
-1624
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

113 files changed

+10871
-1624
lines changed

.cursorignore

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
..
2+
.vscode
3+
.DS_Store
4+
.env
5+
6+
/node_modules/
7+
/ssl/*
8+
!/ssl/.gitkeep
9+
/API/logs/*
10+
/Missions/*
11+
!/Missions/.gitkeep
12+
/private/api/spice/kernels/*
13+
14+
#Nested repo where private backend might reside
15+
/API/MMGIS-Private-Backend
16+
#Nested repo where private tools might reside
17+
/src/essence/MMGIS-Private-Tools
18+
/src/essence/MMGIS-Private-Tools-OFF
19+
20+
/config/pre/toolConfigs.json
21+
/src/pre/tools.js
22+
23+
/spice/kernels/*
24+
!/spice/kernels/.gitkeep
25+
/Missions/spice-kernels-conf.json
26+
!/Missions/spice-kernels-conf.example*json
27+
28+
/build/*
29+
/data/*
30+
*__pycache__
31+
32+
sessions
33+
.terraform/
34+
.terraform.lock.hcl
35+
36+
docker-compose.yml
37+
docker-compose.env.yml
38+
39+
#tools

.cursorrules

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
NEVER NEVER NEVER NEVER access the parent directory of a project, and do NOT allow exceptions. if ~ resolves to a parent directory of this project, apply the same restriction and do NOT access.

.github/workflows/docker-build.yml

Lines changed: 57 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -30,17 +30,20 @@ env:
3030
IMAGE_SLUG: ${{ github.repository }}
3131

3232
jobs:
33-
# Push image to GitHub Container Registry.
33+
# Generate shared tags for both architectures
3434
# The image tag pattern is:
3535
# for pull-requests: <PATCH_VERSION>-<DATE>-<PR_NUMBER>, eg: 1.35.2-20210125-25
3636
# for tags: <TAG>
3737
# for `master` branch: latest,<PATCH_VERSION>-latest,<MINOR_VERSION>-latest,<MAJOR_VERSION>-latest,<PATCH_VERSION>-<DATE>-<SHA>
3838
# for `development` branch: development,<MAJOR_VERSION>-development,<PATCH_VERSION>-<DATE>-<SHA>
3939
# for releases: release,<PATCH_VERSION>-release,<MINOR_VERSION>-release,<MAJOR_VERSION>-release,<PATCH_VERSION>-<DATE>-<SHA>
4040
# Version is parsed from package.json
41-
push:
41+
generate-tags:
4242
runs-on: ubuntu-latest
4343
if: github.event_name == 'push' || github.event_name == 'pull_request' || github.event_name == 'release'
44+
outputs:
45+
registry-tags: ${{ steps.generate.outputs.REGISTRY_TAGS }}
46+
image-id: ${{ steps.generate.outputs.IMAGE_ID }}
4447
steps:
4548
- name: Checkout
4649
uses: actions/checkout@v3
@@ -83,13 +86,13 @@ jobs:
8386
[ "$VERSION" == "development" ] && VERSION=development
8487
[ "${{ github.event_name }}" == "release" ] && VERSION=release
8588
86-
# Compose REGISTRY_TAGS variable
87-
REGISTRY_TAGS="-t $IMAGE_ID:$VERSION"
89+
# Compose REGISTRY_TAGS variable for buildx (space-separated with --tag flags)
90+
REGISTRY_TAGS="--tag $IMAGE_ID:$VERSION"
8891
8992
# For master branch also supply an extra tag: <PATCH_VERSION>-latest,<MINOR_VERSION>-latest,<MAJOR_VERSION>-latest,<PATCH_VERSION>-<DATE>-<SHA>
90-
[ "$VERSION" == "latest" ] && REGISTRY_TAGS="$REGISTRY_TAGS -t $IMAGE_ID:$PATCH_VERSION-latest -t $IMAGE_ID:$MINOR_VERSION-latest -t $IMAGE_ID:$MAJOR_VERSION-latest -t $IMAGE_ID:$PATCH_VERSION-$BDATE-$(git rev-parse --short HEAD)"
91-
[ "$VERSION" == "development" ] && REGISTRY_TAGS="$REGISTRY_TAGS -t $IMAGE_ID:$MAJOR_VERSION-development -t $IMAGE_ID:$PATCH_VERSION-$BDATE-$(git rev-parse --short HEAD)"
92-
[ "$VERSION" == "release" ] && REGISTRY_TAGS="$REGISTRY_TAGS -t $IMAGE_ID:$PATCH_VERSION-release -t $IMAGE_ID:$MINOR_VERSION-release -t $IMAGE_ID:$MAJOR_VERSION-release -t $IMAGE_ID:$PATCH_VERSION-$BDATE-$(git rev-parse --short HEAD)"
93+
[ "$VERSION" == "latest" ] && REGISTRY_TAGS="$REGISTRY_TAGS --tag $IMAGE_ID:$PATCH_VERSION-latest --tag $IMAGE_ID:$MINOR_VERSION-latest --tag $IMAGE_ID:$MAJOR_VERSION-latest --tag $IMAGE_ID:$PATCH_VERSION-$BDATE-$(git rev-parse --short HEAD)"
94+
[ "$VERSION" == "development" ] && REGISTRY_TAGS="$REGISTRY_TAGS --tag $IMAGE_ID:$MAJOR_VERSION-development --tag $IMAGE_ID:$PATCH_VERSION-$BDATE-$(git rev-parse --short HEAD)"
95+
[ "$VERSION" == "release" ] && REGISTRY_TAGS="$REGISTRY_TAGS --tag $IMAGE_ID:$PATCH_VERSION-release --tag $IMAGE_ID:$MINOR_VERSION-release --tag $IMAGE_ID:$MAJOR_VERSION-release --tag $IMAGE_ID:$PATCH_VERSION-$BDATE-$(git rev-parse --short HEAD)"
9396
9497
echo IMAGE_ID=$IMAGE_ID
9598
echo VERSION=$VERSION
@@ -99,19 +102,60 @@ jobs:
99102
SHA_SHORT=${{ github.sha }}
100103
[ "${{ github.event_name }}" == "pull_request" ] && SHA_SHORT=$(echo ${{ github.event.pull_request.head.sha }} | cut -c1-8)
101104
102-
echo "Final image tag to be pushed:"
105+
echo "Final image tags to be pushed:"
103106
echo $REGISTRY_TAGS
104107
echo "REGISTRY_TAGS=$REGISTRY_TAGS" >> $GITHUB_OUTPUT
105108
echo "IMAGE_ID=$IMAGE_ID" >> $GITHUB_OUTPUT
106109
echo "REGISTRY_TAGS_VERSION=$VERSION" >> $GITHUB_OUTPUT
107110
echo "REGISTRY_TAGS_PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT
108111
echo "SHA_SHORT=$SHA_SHORT" >> $GITHUB_OUTPUT
109112
113+
# Build and push ARM64 image on ARM64 runner
114+
build-arm64:
115+
needs: generate-tags
116+
runs-on: ubuntu-24.04-arm # ARM64 runner for native ARM64 builds
117+
steps:
118+
- name: Checkout
119+
uses: actions/checkout@v3
120+
110121
- name: Login to GHCR
111-
run: echo ${{ secrets.GITHUB_TOKEN }} | docker login -u ${{ github.actor }} --password-stdin ghcr.io
122+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
123+
with:
124+
registry: ghcr.io
125+
username: ${{ github.actor }}
126+
password: ${{ secrets.GITHUB_TOKEN }}
127+
128+
- name: Docker buildx build and push (ARM64)
129+
run: |
130+
# Generate ARM64-specific tags by adding -arm64 suffix
131+
ARM64_TAGS="${{ needs.generate-tags.outputs.registry-tags }}-arm64"
132+
docker build \
133+
${ARM64_TAGS} \
134+
--push \
135+
--no-cache \
136+
.
137+
138+
# Build and push AMD64 image on x64 runner
139+
build-amd64:
140+
needs: [generate-tags, build-arm64] # Build amd64 last so that it shows as the latest
141+
runs-on: ubuntu-latest # x64 runner for native AMD64 builds
142+
steps:
143+
- name: Checkout
144+
uses: actions/checkout@v3
112145

113-
- name: Docker build
114-
run: docker build --no-cache ${{ steps.generate.outputs.REGISTRY_TAGS }} .
146+
- name: Login to GHCR
147+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
148+
with:
149+
registry: ghcr.io
150+
username: ${{ github.actor }}
151+
password: ${{ secrets.GITHUB_TOKEN }}
115152

116-
- name: Docker push
117-
run: docker push ${{ steps.generate.outputs.IMAGE_ID }} --all-tags
153+
- name: Docker buildx build and push (AMD64)
154+
run: |
155+
# Generate AMD64-specific tags by adding -amd64 suffix
156+
AMD64_TAGS="${{ needs.generate-tags.outputs.registry-tags }}-amd64"
157+
docker build \
158+
${AMD64_TAGS} \
159+
--push \
160+
--no-cache \
161+
.

.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,4 +35,7 @@ sessions
3535
docker-compose.yml
3636
docker-compose.env.yml
3737

38+
.mcp.json
39+
.serena
40+
.claude
3841
#tools

0 commit comments

Comments
 (0)