dotnet / dotnet/maui

GTK MapRenderer uses IP Services for geolocation.

Open
#8,614 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area-controls-map partner platform/linux s/triaged s/verified t/bug t/housekeeping ♻︎
Dominant language
C#
Stars
23.3k
Forks
2k
Avg merge
1d 14h
Merged PRs (30d)
296

Description

Description

The GTK MapRenderer (A compatibility control that I'm not sure can be used with MAUI proper) uses an interesting way of getting a user's location.

https://github.com/dotnet/maui/blob/main/src/Compatibility/Maps/src/GTK/MapRenderer.cs#L296-L330

We're calling out to http://checkip.dyndns.org/ to get a user's IP Address. Then, we feed that to http://freegeoip.net to get the user's general location. This has multiple negative implications. I don't think a user agrees to use those services when they use that control. They can't control if they allow their position to be used. It's also using 'http' endpoints.

This was most likely copied directly from Xamarin.Forms and never changed (judging by the history of the file and that the last commit was the renaming of files, I think that's right) but even if you can't actively use it, it should be either fixed or removed. Having non secure endpoints being used for geolocation and not something either based on platform code or something a user opts into isn't good, IMO.

Steps to Reproduce

Look at the code I linked to.

Version with bug

Unknown/Other (please specify)

Last version that worked well

Unknown/Other

Affected platforms

Other (Tizen, Linux, etc. not supported by Microsoft directly)

Affected platform versions

GTK (Linux?)

Did you find any workaround?

No response

Relevant log output

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect src/Compatibility/Maps/src/GTK/MapRenderer.cs around lines 296-330, where the GTK MapRenderer calls checkip.dyndns.org and freegeoip.net. First trace how this compatibility control is used and whether the GTK implementation has tests or callers. Done means resolving or removing the non-secure, non-opt-in geolocation behavior and covering the resulting behavior where tests exist.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
desktop, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.