Page MenuHomePhabricator

Security Readiness Review For maplibre-gl-js
Open, Stalled, LowPublic

Description

Project Information

Description of the tool/project:
MapLibre GL is a community-led fork derived from mapbox-gl-js prior to their switch to a non-OSS license. This library provides multiple features for cient-side maps display, including a WebGL rendering for vector-tile rendering, which we intend to do for dynamic maps in the Maps (Kartographer) extension.

Description of how the tool will be used at WMF:
The tool will be used alongside Leaflet, which we already use as Map client-side framework for dynamic maps display. The intention is move the tile rendering to the client and simplify the server-side architecture as part of the following epic T263854: [Maps] Modernize Vector Tile Infrastructure. This library will be packaged and deployed in the Kartographer extension as part of its assets.

Dependencies

List dependencies, or upstream projects that this project relies on.

  • "@mapbox/geojson-rewind": "^0.5.0"
  • "@mapbox/geojson-types": "^1.0.2"
  • "@mapbox/jsonlint-lines-primitives": "^2.0.2"
  • "@mapbox/mapbox-gl-supported": "^1.5.0"
  • "@mapbox/point-geometry": "^0.1.0"
  • "@mapbox/tiny-sdf": "^1.1.1"
  • "@mapbox/unitbezier": "^0.0.0"
  • "@mapbox/vector-tile": "^1.3.1"
  • "@mapbox/whoots-js": "^3.1.0"
  • "csscolorparser": "~1.0.3"
  • "earcut": "^2.2.2"
  • "geojson-vt": "^3.2.1"
  • "gl-matrix": "^3.2.1"
  • "grid-index": "^1.1.0"
  • "minimist": "^1.2.5"
  • "murmurhash-js": "^1.0.0"
  • "pbf": "^3.2.1"
  • "potpack": "^1.0.1"
  • "quickselect": "^2.0.0"
  • "rw": "^1.3.3"
  • "supercluster": "^7.1.0"
  • "tinyqueue": "^2.0.3"
  • "vt-pbf": "^3.1.1"

Has this project been reviewed before?
No

Working test environment

Please link or describe setup process for setting up a test environment.

Post-deployment

Name of team responsible for tool/project after deployment and primary contact.

Product-Infrastructure-Team-Backlog is the official maintainer of the extension and will continue it afterwards.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
sbassett triaged this task as Medium priority.Feb 11 2021, 4:39 PM
sbassett changed the task status from Open to Stalled.Feb 17 2021, 3:58 PM
sbassett lowered the priority of this task from Medium to Low.
sbassett added a subscriber: sbassett.

Added to Q4 planning column for Q4 review.

Hey @MSantos - we're looking at having an external vendor complete this review. Whether or not that happens, or we perform the review internally, we'll plan to have an update for you within two weeks (2021-04-28).

Thanks @sbassett, that sounds great! I have one question for you, is there still time to squeeze in a plugin that will use this library for RTL text rendering? Should I create another task?

The plugin in question is https://github.com/mapbox/mapbox-gl-rtl-text will need to be forked because it wasn't yet forked by Maplibre but the only dependency is the WebGL renderer described in this ticket.

Here is the reasoning behind the need of this plugin T280040: Solution for right-to-left labels

Thanks @sbassett, that sounds great! I have one question for you, is there still time to squeeze in a plugin that will use this library for RTL text rendering? Should I create another task?

Yes, let's create a separate task for now, as these reviews will likely need to be performed separately, at separate times. Thanks.