backport hillshade fix (#986)

developmentseed · Sep 19, 2024 · 9c0c8c4 · 9c0c8c4
1 parent 0b102f3
commit 9c0c8c4
Show file tree

Hide file tree

Showing 7 changed files with 62 additions and 27 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -1,5 +1,11 @@
 # Release Notes
 
+## 0.18.7 (2024-09-19)
+
+* fix Hillshade algorithm (bad `azimuth` angle) (https://github.com/developmentseed/titiler/pull/985) [Backported]
+* Encode URL for cog_viewer and stac_viewer (author @guillemc23, https://github.com/developmentseed/titiler/pull/961) [Backported]
+* Improve XSS security for HTML templates (author @jcary741, https://github.com/developmentseed/titiler/pull/953) [Backported]
+
 ## 0.18.6 (2024-08-27)
 
 * Switch back to `fastapi` instead of `fastapi-slim` and use `>=0.109.0` version

diff --git a/docs/src/benchmark.html b/docs/src/benchmark.html
@@ -103,8 +103,9 @@
       <div class="spacer"></div>
       <div class="small">Powered by <a rel="noopener" href="https://github.com/marketplace/actions/continuous-benchmark">github-action-benchmark</a></div>
     </footer>
-
-    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/Chart.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.9.2/Chart.min.js"
+    integrity="sha512-uWTfEVcTAr+NF8RnQix39Vnfd93celVTAjU2pi4LpdrsPLeLg5RYywi5rw9oF8oCQaJ6b2YPALceNbf3kfDJaA=="
+    crossorigin="anonymous" referrerpolicy="no-referrer"></script>
     <script id="main-script">
     'use strict';
       (function() {

diff --git a/src/titiler/application/titiler/application/templates/index.html b/src/titiler/application/titiler/application/templates/index.html
@@ -4,8 +4,10 @@
     <title>{{ template.title }}</title>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
-    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.3/css/bootstrap.min.css" />
-    <style>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.5.3/css/bootstrap.min.css"
+    integrity="sha512-oc9+XSs1H243/FRN9Rw62Fn8EtxjEYWHXRvjS43YtueEewbS6ObfXcJNyohjHqVKFPoXXUxwc+q1K7Dee6vv9g=="
+    crossorigin="anonymous" referrerpolicy="no-referrer"/>
+<style>
       html { position: relative; min-height: 100%; }
       body { padding-top: 5rem; margin-bottom: 40px; }
       #page { padding: 1.5rem 1.5rem; }
@@ -19,8 +21,12 @@
         display: inline;
       }
     </style>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
-    <script src="https://files.dnr.state.mn.us/lib/bootstrap4/javascripts/bootstrap.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js"
+    integrity="sha512-894YE6QWD5I59HgZOGReFYm4dnWc1Qt5NtvYSaNcOP+u1T9qYdvdihz0PPSiiqn/+/3e7Jo4EaG7TubfWGUrMQ=="
+    crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.5.3/js/bootstrap.min.js"
+    integrity="sha512-8qmis31OQi6hIRgvkht0s6mCOittjMa9GMqtK9hes5iEQBQE/Ca6yGE5FsW36vyipGoWQswBj/QBm2JR086Rkw=="
+    crossorigin="anonymous" referrerpolicy="no-referrer"></script>
   </head>
   <body>
     <nav class="navbar navbar-expand-md navbar-light fixed-top bg-light">

diff --git a/src/titiler/core/titiler/core/algorithm/dem.py b/src/titiler/core/titiler/core/algorithm/dem.py
@@ -31,12 +31,14 @@ def __call__(self, img: ImageData) -> ImageData:
         x, y = numpy.gradient(img.array[0])
         slope = numpy.pi / 2.0 - numpy.arctan(numpy.sqrt(x * x + y * y))
         aspect = numpy.arctan2(-x, y)
-        azimuthrad = self.azimuth * numpy.pi / 180.0
+        azimuth = 360.0 - self.azimuth
+        azimuthrad = azimuth * numpy.pi / 180.0
         altituderad = self.angle_altitude * numpy.pi / 180.0
         shaded = numpy.sin(altituderad) * numpy.sin(slope) + numpy.cos(
             altituderad
         ) * numpy.cos(slope) * numpy.cos(azimuthrad - aspect)
         data = 255 * (shaded + 1) / 2
+        data[data < 0] = 0  # set hillshade values to min of 0.
 
         bounds = img.bounds
         if self.buffer:

diff --git a/src/titiler/core/titiler/core/templates/map.html b/src/titiler/core/titiler/core/templates/map.html
@@ -4,10 +4,18 @@
         <meta charset='utf-8' />
         <title>TiTiler Map Viewer</title>
         <meta name='viewport' content='initial-scale=1,maximum-scale=1,user-scalable=no' />
-        <link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/leaflet.css"/>
-        <script src="https://unpkg.com/[email protected]/dist/leaflet.js"></script>
-        <script src="https://unpkg.com/[email protected]/dist/proj4.js"></script>
-        <script src="https://unpkg.com/[email protected]/src/proj4leaflet.js"></script>
+        <link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/leaflet.css"
+          integrity="sha384-o/2yZuJZWGJ4s/adjxVW71R+EO/LyCwdQfP5UWSgX/w87iiTXuvDZaejd3TsN7mf"
+          crossorigin="anonymous"/>
+        <script src="https://unpkg.com/[email protected]/dist/leaflet.js"
+          integrity="sha384-okbbMvvx/qfQkmiQKfd5VifbKZ/W8p1qIsWvE1ROPUfHWsDcC8/BnHohF7vPg2T6"
+          crossorigin="anonymous"></script>
+        <script src="https://unpkg.com/[email protected]/dist/proj4.js"
+          integrity="sha384-R7x++v2MKcATI+D1/GJsn636xbHca492Sdpm8BD36lj5vdWB9+OUBpM1oKkrzqv9"
+          crossorigin="anonymous"></script>
+        <script src="https://unpkg.com/[email protected]/src/proj4leaflet.js"
+          integrity="sha384-aDnBHDK9AhLbrYhThBxEVMriFbix8Sz2059IlD3HbZhz7+WNmz+pSkOcI7MY72cE"
+          crossorigin="anonymous"></script>
         <style>
             body { margin:0; padding:0; width:100%; height:100%; background-color: #e5e5e5;}
             #map { position:absolute; top:0; bottom:0; width:100%; }

diff --git a/src/titiler/extensions/titiler/extensions/templates/cog_viewer.html b/src/titiler/extensions/titiler/extensions/templates/cog_viewer.html
@@ -4,13 +4,19 @@
     <meta charset='utf-8' />
     <title>TiTiler - Cloud Optimized GeoTIFF Viewer</title>
     <meta name='viewport' content='initial-scale=1,maximum-scale=1,user-scalable=no' />
-
-    <script src='https://unpkg.com/[email protected]/dist/maplibre-gl.js'></script>
-    <link href='https://unpkg.com/[email protected]/dist/maplibre-gl.css' rel='stylesheet' />
-
-    <link href='https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.min.css' rel='stylesheet'>
-    <script src='https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.js'></script>
-    <script src="https://d3js.org/d3.v4.js"></script>
+    <script src="https://unpkg.com/[email protected]/dist/maplibre-gl.js"
+      integrity="sha384-d7ZDjW8dICoRWC3wnExUiOx1CgEcPFEPJmTdIo93yyxQLAUbUwa6yKg3tlACCOMf"
+      crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/maplibre-gl.css"
+      integrity="sha384-g0Ap4cGP18FAKniFM6i06oyjTpBYleD9hZcGyVnlsc1JFbfedDo1Oqb9qxrxVB3a" crossorigin="anonymous"/>
+    <link rel="stylesheet" href="https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.min.css"
+      integrity="sha384-J8dqIWgJSfbM291RNLiN7cjnxOqlHjAWfkLu/3HiuC1pJLq9ZCYiigcknWfCYi+h" crossorigin="anonymous"/>
+    <script src="https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.js"
+      integrity="sha384-cARSC/qj9L62maU7YhlT+Ca2yHyUEEnWvMVCilUdW02txMg0Iynxz3gMsvVpV9RG"
+      crossorigin="anonymous"></script>
+    <script src="https://d3js.org/d3.v4.js"
+      integrity="sha384-2D+rRoPOU+IYMo2i8sD/TSf9L+6H+Dt8lxmKl1r7xyEcV83QdtJyeaoE1DHIG3F7"
+      crossorigin="anonymous"></script>
     <style>
       body { margin:0; padding:0; width:100%; height:100%;}
       #map { position:absolute; top:0; bottom:0; width:100%; }
@@ -894,7 +900,7 @@
 }
 
 document.getElementById('launch').addEventListener('click', () => {
-  scope.url = document.getElementById('cogeo').value
+  scope.url = encodeURIComponent(document.getElementById('cogeo').value)
   document.getElementById('selector').classList.toggle('none')
   addCogeo()
 })

diff --git a/src/titiler/extensions/titiler/extensions/templates/stac_viewer.html b/src/titiler/extensions/titiler/extensions/templates/stac_viewer.html
@@ -4,13 +4,19 @@
     <meta charset='utf-8' />
     <title>TiTiler - STAC Viewer</title>
     <meta name='viewport' content='initial-scale=1,maximum-scale=1,user-scalable=no' />
-
-    <script src='https://unpkg.com/[email protected]/dist/maplibre-gl.js'></script>
-    <link href='https://unpkg.com/[email protected]/dist/maplibre-gl.css' rel='stylesheet' />
-
-    <link href='https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.min.css' rel='stylesheet'>
-    <script src='https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.js'></script>
-    <script src="https://d3js.org/d3.v4.js"></script>
+    <script src="https://unpkg.com/[email protected]/dist/maplibre-gl.js"
+      integrity="sha384-d7ZDjW8dICoRWC3wnExUiOx1CgEcPFEPJmTdIo93yyxQLAUbUwa6yKg3tlACCOMf"
+      crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/maplibre-gl.css"
+      integrity="sha384-g0Ap4cGP18FAKniFM6i06oyjTpBYleD9hZcGyVnlsc1JFbfedDo1Oqb9qxrxVB3a" crossorigin="anonymous"/>
+    <link rel="stylesheet" href="https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.min.css"
+      integrity="sha384-J8dqIWgJSfbM291RNLiN7cjnxOqlHjAWfkLu/3HiuC1pJLq9ZCYiigcknWfCYi+h" crossorigin="anonymous"/>
+    <script src="https://api.mapbox.com/mapbox-assembly/v0.23.2/assembly.js"
+      integrity="sha384-cARSC/qj9L62maU7YhlT+Ca2yHyUEEnWvMVCilUdW02txMg0Iynxz3gMsvVpV9RG"
+      crossorigin="anonymous"></script>
+    <script src="https://d3js.org/d3.v4.js"
+      integrity="sha384-2D+rRoPOU+IYMo2i8sD/TSf9L+6H+Dt8lxmKl1r7xyEcV83QdtJyeaoE1DHIG3F7"
+      crossorigin="anonymous"></script>
     <style>
       body { margin:0; padding:0; width:100%; height:100%;}
       #map { position:absolute; top:0; bottom:0; width:100%; }
@@ -1012,7 +1018,7 @@
 }
 
 document.getElementById('launch').addEventListener('click', () => {
-  scope.url = document.getElementById('stac').value
+  scope.url = encodeURIComponent(document.getElementById('stac').value)
   document.getElementById('selector').classList.toggle('none')
   document.getElementById('loader').classList.add('off')
   addStac()