[Security Alert]: Polyfill.io Issue for Google Maps Platform users in Angular

Question

My web app is in Angular and today I got a message from Google Cloud Platform, its mentioned a "Notification Title: [Security Alert]: Polyfill.io Issue for Google Maps Platform users". How can we resolve the issue? Angular has its builtin polyfills.ts which is mandatory and installs with the project by default.

A lot of users using the WordPress Google Map plugin report this issue. But, the same is occurring with my angular application. My project does not include any third party polyfills cdn for the map or so. I am using primeng's Gmap with Google's Map platform combined.

Here they say it, but I can't find polyfill.io to remove from my code.

What am I missing here? Is it with my project missing or outdated any library/packages? If so, which one?

Chavers

Answer 1

Polyfill.io was owned by the Financial Times web team, then moved under community management, and the last maintainer sold the project to a strange Chinese CDN company, and they moved it away from Fastly (the CDN / Edge compute platform running the OSS code for the service) and started to mess with the returned files.

If you're using Polyfill.io code on your site – like 100,000+ are – remove it immediately

Google has become aware of a security issue that may be affecting websites using specific third-party libraries (including polyfill.io). This issue can sometimes redirect visitors away from the intended website without website owner knowledge or permission, or potentially cause other malicious behavior. Many of the Maps JavaScript API samples in the Developer Documentation previously included a polyfill.io script declaration.

The problem is your third-party Google Map library that is using Polyfill.io. Try for updates or replace it.

Delegacy

but how can I get to know the which specific library I am using is using any instance of polyfill.io under the hood. All I can do is search for polyfill.io globally in my project which I am doing now and getting not a single result for it. – Chavers

Try the one for Google Maps. – Delegacy

Answer 2

As far as I know polyfill.ts has no relation to polyfill.io.

It's a notice to warn users about the vulnerability and not directly pointing at your code that there is a problem.

For the safe side, Do a global search of your project including node_modules for the keyword polyfill.io; if you have it, identify the package and uninstall or check for a new version, if not ignore and proceed.

Just check if .gitignore has node_modules. If that is present, then you will not see the result in global search of vscode/maybe other editors also.

Maricela

exactly polyfill.ts and polyfill.io both are not relatable to each other. Also, i did the global search for polyfill.io in my whole project and did not find a single search for it. – Chavers

@Chavers Just check if .gitignore has node_modules. If that is present, then you will not see the result in global search of vscode! – Maricela

I am using webstorm and not vscode. In webstorm i need to do the same? – Chavers

@Chavers I think so, not sure though – Maricela

I have tried by removing the node_modules and recompiling the code. Still same output. – Chavers

@Chavers I just was talking about search, if there are no results, I think its ok – Maricela

Something else you can do is open your site in a browser on a page containing a map, with the Developer Tools panel open. Go to the Network tab, make sure "All" types of file are selected and then search/scan for polyfill.io in the list of requests. (Though you should still search your sourcecode too.) – Passing

Answer 3

This can also come from Google Maps API samples. Google maps samples used polyfill.io references and they removed it from their side now.

If you are using those samples in your repo, removing them should fix the issue. If you are not using code samples, then you can ignore this warning if it's come from google maps libs.

You can find the more details in this googlemaps issue and here's the fix MR from their side - https://github.com/googlemaps/js-samples/pull/1675/files

Neman