A default, bare bones implementation of MapBox appears to 'eat' about every other click on android, and intermittently on iOS, to the point it would be impossible to use this system in any kind of production environment on mobile.

By 'eat clicks' I am speaking specifically about tapping the zoom or layer buttons, etc. Is the MapBox team aware of this issue and is there any time window to expect a fix?

I'm observing 2 likely related issues w/ mapbox.js HEAD and IE9 (9.0.8112):

1. mapbox.load() sporadically returning an empty tilejson object
2. interactivity dead where MapBox hosting returns 304 (not modified)

Example

• http://mapbox.com/frame/?villeda.map-m1aei9is#5.00/34.866/-73.903
• http://gis.nyc.gov/oem/he/map.htm (they're about to apply a fix for (1) where they'll embed the tilejson hash in the application, so issue 2 should be nicely observable there).

I cannot reproduce these issues with an older setup, e. g.:

http://www.npr.org/censusmap/#6.00/41.152/-90.943

As it stands using JSPM to load mapbox fails badly. This is unfortunate for me, since I would like to use mapbox instead of vanilla leaflet (which works under JSPM)

I might be able to figure out how to fi this, but if you guys have ideas (or just suggestions to speed me up) that would be really helpful

-Chris

• [x] We need a page to link to to show examples
• [x] We need a page to link to to show plugins
• [x] We need to add an obvious link back to mapbox. This means a logo like the rest of the site, not a hexagon or a text link.
• [x] Framing for plugins landing page
• [x] Framing for examples landing page

I'm working on a new landing page for the site and want to emphasize our examples as a way to get started. In general, I would like to see a better search for examples implemented on this page and trying out a full width example layout. Here's a quick wireframe of what I have in mind:

• Searching for examples is emphasized at the top.
• Example subject with links are exposed in a pane. I think this column layout will lend itself some stronger readability over what we currently have:

• Code output is toggled and contained in the same panel as the example.
• Optional content space below to walk through more elaborate examples.

cc @geografa @tmcw

I don't have much data yet. Anecdotally, I know, that at somepoint after mapbox load, it will no longer load in new tiles to fill an expanded container when the window is resized.

I'm creating a map with Mapbox.js and I have a problem. I've added some markers to the map with a popup on each of them. Testing this on Chrome Desktop it works well, when I click the marker it shows the popup. But when I'm trying to do the same on mobile (Android and iOS) it doesn't work at all. On mobile the popup is never shown when I touch on them.

Anyone know why is this happening? And how to solve it?

Thanks

What version of leaflet is mapbox.js supposed to support? package.json has 0.7.3, but calling L.version on an example page returns 0.7.2.

Further, a page that loads V 2.1.4 of mapbox.js returns 2.1.3 when L.mapbox.VERSION is called.

Example Page https://www.mapbox.com/mapbox.js/api/v2.1.4/

@jfirebaugh OTOH when using the Mapbox v4 api mapbox.js can:

• Drop all handling/logic around the autoscale flag in tilejson,
• Leave the 256 virtual pixel (DOM) image size alone,
• Append the @2x suffix to tile URLs when window.devicePixelRatio says so.

The only thing that needs to change when on a retina screen is using the @2x suffix.

cc @tmcw

• Added overflow-auto and max height to popups
• Fixed overly broad and aggressive rule intended for tiles that was interfering with image styles in popups
• Made base type styles smaller

From:

To:

:full_moon_with_face:

I have a dream of a website that's like Natural Earth except it serves GeoJSON, pre-simplified to rational browser sizes. So, the basics like:

• US States
• Countries
• ZCTAs
• Congressional Districts

So, like us-atlas except GeoJSON-focused, not TopoJSON, you don't need to run a makefile, you can just download them, properties are included, and they are simplified to rational sizes.

Thoughts? @ajashton @mourner ?

I was doing some feature testing with Puerto Rican locations and found that at least one location returns a postCode of 920 rather than 00920 while several others with leading zeros return the full zip code. This was easy to handle for in our code but ideally it could be fixed in the db so that this exception doesn't surprise others.

location tested using forward search: 1332 Avenida Franklin Delano Roosevelt San Juan, Puerto Rico

Returned from api:

Verified zip code should be 00920:

Requesting a patch/fixed issue vulnerabilities as pull-request 🐛 in #1365

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

Describe the bugs: 🐛

lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Prototype Pollution. The function zipObjectDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

PoC

const _ = require('lodash'); _.zipObjectDeep(['__proto__.z'],[123]) console.log(z) // 123

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge
• Property definition by path

Unsafe Object recursive merge The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
foreach property of source

if property exists and is an object on both the target and the source merge(target[property], source[property]) else target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source). lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Affected environments

• The following environments are susceptible to a Prototype Pollution attack:
• Application server
• Web server
• Web browser

CVE-2020-8203 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H GHSA-p6mc-m468-83gw

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

CVE-2021-28834 GHSA-52p9-v744-mwjj

Descriptions Issue 👍

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

CVE-2020-14001 9.8 / 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

imhunterand fix 2 alerts in Gemfile.lock