Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
googlemaps/android-maps-utils
main @ d011a44
4
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Command Injection: 1 prior fix. Scrutinize any change in this area.
library/src/main/java/com/google/maps/android/data/kml/KmlRenderer.java: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: KML rendering logic permitted the loading of arbitrary URLs, leading to path traversal and unauthorized reading of local files on the device via fallback mechanisms. This was mitigated by enforcing strict URL protocol restrictions and stripping local file retrieval capabilities.
SSRF: External resource requests made during KML processing allowed arbitrary redirect targets and SSRF. Mitigation introduced the KmlUrlSanitizer API to sanitise and restrict both initial requests and redirect destinations.
Tapjacking: Map Utility layout definitions lacked touch-filtering attributes, leaving user interface interactions vulnerable to overlay attacks. The fix explicitly enabled 'filterTouchesWhenObscured' on target layouts.