Merge pull request #182 from CartoDB/sprite-limit

More secure sprite limit

lib/torque/renderer/cartocss_render.js

@@ -2,6 +2,7 @@
   // min value to render a line. 
   // it does not make sense to render a line of a width is not even visible
   var LINEWIDTH_MIN_VALUE = 0.05; 
+  var MAX_SPRITE_RADIUS = 255;
 
   function renderPoint(ctx, st) {
     ctx.fillStyle = st['marker-fill'];
@@ -78,13 +79,13 @@
       if (st['marker-fill-opacity'] !== undefined || st['marker-opacity'] !== undefined) {
         ctx.globalAlpha = st['marker-fill-opacity'] || st['marker-opacity'];
       }
-      var maxSpriteRadius = 255;
-      ctx.drawImage(img, 0, 0, Math.min(img.width, maxSpriteRadius), Math.min(img.height, maxSpriteRadius));
+      ctx.drawImage(img, 0, 0, Math.min(img.width, MAX_SPRITE_RADIUS), Math.min(img.height, MAX_SPRITE_RADIUS));
     }
   }
 
 module.exports = {
     renderPoint: renderPoint,
     renderSprite: renderSprite,
-    renderRectangle: renderRectangle
+    renderRectangle: renderRectangle,
+    MAX_SPRITE_RADIUS: MAX_SPRITE_RADIUS
 };

lib/torque/renderer/point.js

@@ -137,8 +137,8 @@ var Filters = require('./torque_filters');
       if (qualifiedUrl && this._iconsToLoad <= 0 && this._icons[qualifiedUrl]) {
         var img = this._icons[qualifiedUrl];
 
-        var dWidth = st['marker-width'] * 2 || img.width;
-        var dHeight = (st['marker-height'] || dWidth) * (img.width / img.height);
+        var dWidth =  Math.min(st['marker-width'] * 2 || img.width, cartocss.MAX_SPRITE_RADIUS * 2);
+        var dHeight = Math.min((st['marker-height'] || dWidth) * (img.width / img.height), cartocss.MAX_SPRITE_RADIUS * 2);
 
         canvas.width = ctx.width = dWidth;
         canvas.height = ctx.height = dHeight;