GTK MapRenderer uses IP Services for geolocation.
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 23.3k
- Forks
- 2k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 296
Description
Description
The GTK MapRenderer (A compatibility control that I'm not sure can be used with MAUI proper) uses an interesting way of getting a user's location.
https://github.com/dotnet/maui/blob/main/src/Compatibility/Maps/src/GTK/MapRenderer.cs#L296-L330
We're calling out to http://checkip.dyndns.org/ to get a user's IP Address. Then, we feed that to http://freegeoip.net to get the user's general location. This has multiple negative implications. I don't think a user agrees to use those services when they use that control. They can't control if they allow their position to be used. It's also using 'http' endpoints.
This was most likely copied directly from Xamarin.Forms and never changed (judging by the history of the file and that the last commit was the renaming of files, I think that's right) but even if you can't actively use it, it should be either fixed or removed. Having non secure endpoints being used for geolocation and not something either based on platform code or something a user opts into isn't good, IMO.
Steps to Reproduce
Look at the code I linked to.
Version with bug
Unknown/Other (please specify)
Last version that worked well
Unknown/Other
Affected platforms
Other (Tizen, Linux, etc. not supported by Microsoft directly)
Affected platform versions
GTK (Linux?)
Did you find any workaround?
No response
Relevant log output
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect src/Compatibility/Maps/src/GTK/MapRenderer.cs around lines 296-330, where the GTK MapRenderer calls checkip.dyndns.org and freegeoip.net. First trace how this compatibility control is used and whether the GTK implementation has tests or callers. Done means resolving or removing the non-secure, non-opt-in geolocation behavior and covering the resulting behavior where tests exist.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100