feat: add Workflows plugin (tool + backend)#4
Open
jdrodjpl wants to merge 1 commit into
Open
Conversation
tariqksoliman
requested changes
Jul 23, 2026
| // (LayerInfoModal renders layer.description through showdown). | ||
| function buildLayerDescription(jobId, job) { | ||
| const lines = ['Generated by the Workflows tool.', ''] | ||
| if (job.name) lines.push(`**Run:** ${job.name}`) |
Member
There was a problem hiding this comment.
XSS. Make sure job.names like <img src=x onerror=alert(document.domain)> don't inject code.
Member
There was a problem hiding this comment.
Still complaining about:
- mdSafe() does NOT fully close the stored XSS (this is the important one). It escapes < > & \ |and_ *, which kills the raw-tag and code-span-breakout vectors — but it leaves ", !, [, ], (, )` untouched, so markdown image/link syntax still injects HTML. Confirmed against showdown:
Run name / payload value =
![](https://a/b.png"onerror="alert(document.domain))
→ renders as
<img src="https://a/b.png"onerror="alert(document.domain)" alt="" />
That's an auto-firing onerror (no click needed), stored into the shared mission config → fires for every user who opens that layer's Info modal.
Also [click](javascript:alert(1)) → <a href="javascript:alert(1)">click</a> (click-required, but still stored).
Fix: extend mdSafe() to also escape the double-quote and neutralize markdown link/image punctuation, e.g. append:
.replace(/"/g, '"')
.replace(/[\[\]()!]/g, (m) => '\\' + m)
| lines.push('| Parameter | Value |') | ||
| lines.push('| --- | --- |') | ||
| entries.forEach(([k, v]) => { | ||
| lines.push(`| \`${k}\` | \`${v}\` |`) |
Member
There was a problem hiding this comment.
XSS. Make sure key and values like the following do not inject code.
a`<img src=x onerror=alert(1)>`b
Collaborator
Author
There was a problem hiding this comment.
Addressed in latest push.
Member
|
Oh, also do update the main README.md and add the Workflows plugin to it. Thanks! |
Workflows integration for MMGIS: submit jobs against a configured workflows API (cookie OAuth via inline connect link), track/filter/ rename runs with per-user history, and add completed runs' tile STAC items as mission layers — grouped under a "Workflow Outputs" header, with TiTiler rescale options seeded from item raster statistics and provenance shown in the layer info modal. Backend module stores per-user submission history (endpoint, payload, run name) in the workflow_submissions table. Data-source URI fields carry no baked-in defaults — they're omitted from payloads and the API applies its own deployment-specific defaults server-side. All user-controlled values interpolated into layer descriptions and display names are escaped/stripped against stored XSS (descriptions render through showdown and persist into the shared mission config).
jdrodjpl
force-pushed
the
feat/workflows-plugin
branch
from
July 23, 2026 17:24
cbc9788 to
238e1e1
Compare
Member
|
@jdrodjpl Almost there, just my last message above and then a bit more for the XSS issue |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Workflows integration for MMGIS: submit jobs against a configured workflows API (cookie OAuth via inline connect link), track/filter/ rename runs with per-user history, and add completed runs' tile STAC items as mission layers — grouped under a "Workflow Outputs" header, with TiTiler rescale options seeded from item raster statistics and provenance shown in the layer info modal.
Backend module stores per-user submission history (endpoint, payload, run name) in the workflow_submissions table.
Data-source URI fields carry no baked-in defaults — they're omitted from payloads and the API applies its own deployment-specific defaults server-side.