Fix GitHub Vulnerability (#136)

pages/10_🌍_Earth_Engine_Datasets.py

@@ -1,4 +1,5 @@
 import ee
+import json
 import streamlit as st
 import geemap.foliumap as geemap
 
@@ -110,6 +111,14 @@ def search_data():
                 uid = ee_assets[index]["uid"]
                 st.markdown(f"""**Earth Engine Snippet:** `{ee_id}`""")
                 ee_asset = f"{translate[asset_types[index]]}{ee_id}')"
+
+                if ee_asset.startswith("ee.ImageCollection"):
+                    ee_asset = ee.ImageCollection(ee_id)
+                elif ee_asset.startswith("ee.Image"):
+                    ee_asset = ee.Image(ee_id)
+                elif ee_asset.startswith("ee.FeatureCollection"):
+                    ee_asset = ee.FeatureCollection(ee_id)
+
                 vis_params = st.text_input(
                     "Enter visualization parameters as a dictionary", {}
                 )
@@ -121,11 +130,11 @@ def search_data():
                         if vis_params.strip() == "":
                             # st.error("Please enter visualization parameters")
                             vis_params = "{}"
-                        vis = eval(vis_params)
+                        vis = json.loads(vis_params.replace("'", '"'))
                         if not isinstance(vis, dict):
                             st.error("Visualization parameters must be a dictionary")
                         try:
-                            Map.addLayer(eval(ee_asset), vis, layer_name)
+                            Map.addLayer(ee_asset, vis, layer_name)
                         except Exception as e:
                             st.error(f"Error adding layer: {e}")
                     except Exception as e:

pages/1_📷_Timelapse.py

@@ -1,4 +1,5 @@
 import ee
+import json
 import os
 import warnings
 import datetime
@@ -377,7 +378,9 @@ def app():
                         st.write(
                             cm.plot_colormap(cmap=palette_options, return_fig=True)
                         )
-                        st.session_state["palette"] = eval(palette)
+                        st.session_state["palette"] = json.loads(
+                            palette.replace("'", '"')
+                        )
 
                     if bands:
                         vis_params = st.text_area(
@@ -392,7 +395,9 @@ def app():
                             "{}",
                         )
                     try:
-                        st.session_state["vis_params"] = eval(vis_params)
+                        st.session_state["vis_params"] = json.loads(
+                            vis_params.replace("'", '"')
+                        )
                         st.session_state["vis_params"]["palette"] = st.session_state[
                             "palette"
                         ]
@@ -432,7 +437,7 @@ def app():
                 palette_values,
             )
             st.write(cm.plot_colormap(cmap=palette_options, return_fig=True))
-            st.session_state["palette"] = eval(palette)
+            st.session_state["palette"] = json.loads(palette.replace("'", '"'))
         elif collection == "MODIS Ocean Color SMI":
             with st.expander("Show dataset details", False):
                 st.markdown(
@@ -490,7 +495,7 @@ def app():
                 palette_values,
             )
             st.write(cm.plot_colormap(cmap=palette_options, return_fig=True))
-            st.session_state["palette"] = eval(palette)
+            st.session_state["palette"] = json.loads(palette.replace("'", '"'))
 
         sample_roi = st.selectbox(
             "Select a sample ROI or upload a GeoJSON file:",
@@ -1342,7 +1347,9 @@ def app():
                                 if vis_params.startswith("{") and vis_params.endswith(
                                     "}"
                                 ):
-                                    vis_params = eval(vis_params)
+                                    vis_params = json.loads(
+                                        vis_params.replace("'", '"')
+                                    )
                                 else:
                                     vis_params = None
                                 out_gif = geemap.modis_ocean_color_timelapse(

pages/7_📦_Web_Map_Service.py

@@ -1,4 +1,5 @@
 import ast
+import json
 import streamlit as st
 import leafmap.foliumap as leafmap
 
@@ -19,6 +20,12 @@ st.sidebar.info(
     """
 )
 
+# Define a whitelist of trusted URLs
+trusted_urls = [
+    "https://services.terrascope.be/wms/v2",
+    # Add more trusted URLs here
+]
+
 
 @st.cache_data
 def get_layers(url):
@@ -26,6 +33,10 @@ def get_layers(url):
     return options
 
 
+def is_trusted_url(url):
+    return url in trusted_urls
+
+
 def app():
     st.title("Web Map Service (WMS)")
     st.markdown(
@@ -50,7 +61,14 @@ def app():
         empty = st.empty()
 
         if url:
-            options = get_layers(url)
+
+            if is_trusted_url(url):
+                options = get_layers(url)
+                # Process options as needed
+            else:
+                st.error(
+                    "The entered URL is not trusted. Please enter a valid WMS URL."
+                )
 
             default = None
             if url == esa_landcover:
@@ -79,7 +97,7 @@ def app():
                         url, layers=layer, name=layer, attribution=" ", transparent=True
                     )
             if add_legend and legend_text:
-                legend_dict = ast.literal_eval(legend_text)
+                legend_dict = json.loads(legend_text.replace("'", '"'))
                 m.add_legend(legend_dict=legend_dict)
 
             m.to_streamlit(height=height)

pages/8_🏜️_Raster_Data_Visualization.py

@@ -1,3 +1,4 @@
+import json
 import os
 import leafmap.foliumap as leafmap
 import leafmap.colormaps as cm
@@ -45,6 +46,14 @@ An interactive web app for visualizing local raster datasets and Cloud Optimized
 """
 )
 
+
+def is_trusted_url(url):
+    if url.startswith("https://opendata.digitalglobe.com/events/california-fire-2020/"):
+        return True
+    else:
+        return False
+
+
 row1_col1, row1_col2 = st.columns([2, 1])
 
 with row1_col1:
@@ -59,7 +68,7 @@ with row1_col2:
         cog,
     )
 
-    if url:
+    if is_trusted_url(url):
         try:
             options = leafmap.cog_bands(url)
         except Exception as e:
@@ -74,6 +83,8 @@ with row1_col2:
             pass
         else:
             st.error("Please select one or three bands")
+    else:
+        st.error("Please enter a trusted URL")
 
     add_params = st.checkbox("Add visualization parameters")
     if add_params:
@@ -83,7 +94,7 @@ with row1_col2:
 
     if len(vis_params) > 0:
         try:
-            vis_params = eval(vis_params)
+            vis_params = json.loads(vis_params.replace("'", '"'))
         except Exception as e:
             st.error(
                 f"Invalid visualization parameters. It should be a dictionary. Error: {e}"

pages/9_🔲_Vector_Data_Visualization.py

@@ -21,6 +21,17 @@ st.sidebar.info(
 )
 
 
+# Define a whitelist of trusted URLs
+trusted_urls = [
+    "https://github.com/giswqs/streamlit-geospatial/raw/master/data/us_states.geojson",
+    # Add more trusted URLs here
+]
+
+
+def is_trusted_url(url):
+    return url in trusted_urls
+
+
 def save_uploaded_file(file_content, file_name):
     """
     Save the uploaded file to a temporary directory
@@ -71,7 +82,7 @@ def app():
 
         container = st.container()
 
-        if data or url:
+        if data or is_trusted_url(url):
             if data:
                 file_path = save_uploaded_file(data, data.name)
                 layer_name = os.path.splitext(data.name)[0]