AuWoMe/planish
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

TripMap renders map per pin-set change and leaks emoji into innerHTML #14

New issue
Closed
opened 2026-08-12 03:47:40 +00:00 by Mark · 0 comments
Mark commented 2026-08-12 03:47:40 +00:00
Owner
Copy link

src/components/map/TripMap.tsx: the useEffect depends on [pins] and tears down/recreates the whole Mapbox instance on every pins identity change (each trip page render builds a new pins array), causing map flicker and token churn. Also line 46 injects getItemTypeMeta(pin.type).icon into innerHTML — icons are emoji strings today but this is an XSS-shaped pattern if a pin title/type ever becomes user-controlled. Fix: memoize pins, and build marker DOM with createElement/textContent.

src/components/map/TripMap.tsx: the useEffect depends on [pins] and tears down/recreates the whole Mapbox instance on every pins identity change (each trip page render builds a new pins array), causing map flicker and token churn. Also line 46 injects getItemTypeMeta(pin.type).icon into innerHTML — icons are emoji strings today but this is an XSS-shaped pattern if a pin title/type ever becomes user-controlled. Fix: memoize pins, and build marker DOM with createElement/textContent.
Mark closed this issue 2026-08-13 00:13:12 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:needs-decision

   
bug

   
chore

   
in-progress

Locked by an active fixit pipeline run

  
security/high

High severity security issue

  
security/medium

Medium severity security issue

  
triage-approved
No labels
blocked:needs-decision
bug
chore
in-progress
security/high
security/medium
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
AuWoMe/planish#14
No description provided.