fix(data): prevent SSRF from untrusted KML/GeoJSON icon and GroundOverlay href

[herdiyana256]

Summary

Icon and GroundOverlay <href> URLs are read from the parsed KML/GeoJSON document and fetched without any validation, giving a crafted (untrusted) document a Server-Side Request Forgery (SSRF) primitive.

• Style/IconStyle/Icon/href → KmlStyle.iconUrl
• GroundOverlay/Icon/href → KmlGroundOverlay.imageUrl

Both flow to UrlIconProvider.loadBitmapFromUrl, which did:

val url = URL(urlString)
val connection = url.openConnection() as HttpURLConnection
connection.doInput = true
connection.connect()          // <-- request issued; no validation anywhere

A malicious KML/GeoJSON (downloaded, shared, or user-provided) can therefore make the app issue requests to loopback, link-local (169.254.169.254 metadata), and private-network hosts reachable from the device. HttpURLConnection also follows redirects by default, so a public-looking href can 302 to an internal target.

The KmlUrlSanitizer interface exists but sanitizeUrl(...) is never called anywhere in the codebase (dead code), and KmlLayer/GeoJsonLayer hard-code UrlIconProvider() with no way to inject one — so there was no protection by default and no way for a developer to add one.

Reproduction (network sequence is verbatim from loadBitmapFromUrl)

A KML with <Icon><href>http://127.0.0.1:8474/INTERNAL</href></Icon> (or a 169.254.169.254 / RFC1918 host) causes a real request to that host; a redirector href is followed to the internal target. Confirmed against a local listener that logged the inbound requests.

Fix

• DefaultKmlUrlSanitizer (new): allows only http/https whose host does not resolve to a loopback / any-local / link-local / site-local (RFC 1918) / multicast address; returns null (block) otherwise. Public icon/overlay URLs are unaffected.
• UrlIconProvider now applies a KmlUrlSanitizer (secure default) before every fetch — blocked URLs issue no request — and sets instanceFollowRedirects = false to stop redirect-based bypass. Callers may pass a custom sanitizer, or null to opt out.
• Hermetic unit tests for the sanitizer (IP-literal hosts, no DNS/network).

This makes the previously-dead KmlUrlSanitizer functional and the default behavior secure, without changing the public KmlLayer/GeoJsonLayer API. Verified on a JVM: internal/metadata/RFC1918/redirector/file:// hrefs are blocked with no request issued, while a public host still loads.

Scope / notes

• DNS-rebinding between the sanitizer's resolution and the connection's resolution is a known residual limitation of host-based validation; disabling auto-redirects and failing closed on unresolved hosts substantially reduces the attack surface.

[kikoso]

Hi @herdiyana256 ! Thanks for the contribution, this fixes a real issue.

I have left a few comments, let me know if you want to discuss any of them.

[herdiyana256]

Replied on each thread above. Short version: extra ranges (fc00::/7, 100.64.0.0/10, 192.0.0.0/24) covered, @jvmoverloads added, and redirects are now followed manually with a per-hop re-sanitize and a responseCode check. DNS-rebinding pin is the one open item, left a question about the approach on that thread. The failing check is the jacoco coverage-comment step missing a token on fork PRs, not a test failure.

[kikoso]

Thanks! Yeah, don't worry about the test flow, it doesn't run for remote contributors.

[kikoso]

LGTM

[herdiyana256]

Thanks for the review and approval! Looks like the workflows are just waiting on a maintainer to approve the run for this fork PR. Whenever one of you has a moment to kick that off and merge, I'm happy to rebase if needed.

[kikoso]

Ignore the reporting flow, doesn't work with external contributions