Page MenuHomePhabricator

WikiVoyage nearby articles map layer loads a JS file from toolforge
Open, HighPublic


On wikivoyage, if you go to a page with a map, and click on layers icon top right, and click "nearby articles" or click on the nearby articles icon in top left, the js will load and execute a script from toolforge ( ). The script is basically just data and maintained by wikivoyage community members. (However all the infrastructure around this script is part of the Maps extension, so its not really a gadget)

So beyond the normal complaint of something semi-prod depending on toolforge, it is really unfortunate that this is executing the script instead of just loading it as json data. At the very least could it be changed to be json, so that the people in control of the toolforge account can't arbitrary inject javascript for anyone using this feature?

Event Timeline

Bawolff created this task.Feb 10 2020, 7:58 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 10 2020, 7:58 AM
Bawolff updated the task description. (Show Details)Feb 10 2020, 8:01 AM
Bawolff added a comment.EditedFeb 10 2020, 8:07 AM

I should of course mention, the ideal case would be if this file was generated by the Maps (or some other extension) directly. If its expensive to generate, maybe make it a cached querypage + an api to get it in the right format [Edit: That won't really work well to load all 23,000 entries at once. I don't know. Generate a static file with a cron script? Split it up so looking at nearby articles doesn't require loading 1.4mb all at once?].

sbassett triaged this task as High priority.Feb 10 2020, 4:37 PM
sbassett added a project: Privacy Engineering.
sbassett moved this task from Incoming to Watching on the Security-Team board.
The_RedBurn moved this task from Tracking to All map-related tasks on the Maps board.
TheDJ edited projects, added Maps (Kartographer); removed Maps.Mar 10 2020, 12:40 PM
TheDJ moved this task from Unsorted to Wikivoyage on the Maps (Kartographer) board.
TheDJ added a subscriber: TheDJ.
JFishback_WMF moved this task from Intake to Backlog on the Privacy board.Mar 12 2020, 1:07 AM